Re: sending snoopy log to prewikka
Yoann Vandoorselaere <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <1247235706.31201.56.camel@arwen> |
Hi, Le lundi 16 mars 2009 à 15:28 +0100, Niek Timmers a écrit : > I'm figuring out how I can send the log of snoopylogger (logs to syslog) > to my prelude manager server so it will show up un prewikka. I think > this can be done with prelude-lml but I'm not sure how I can achieve > this. I tried some stuff, this is what I came up with: [...] > My guess is I need to build some pcre rules for the prelude-lml plugin > but I'm not sure. Somebody can point me in the right direction of maybe > have experience with getting snoopylogger logs in prewikka? You are correct, you now need to write a signature that will be able to take care of Snoopylogger input, and translate it to a Prelude events. Do not hesitate to provide us with a bunch of Snoopylogger logs samples, so that we can help in writing the signatures. Regards, -- Yoann Vandoorselaere <[email protected]> _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user