Re: Prelude correlator configuration questions

Hi Jerome,

Le mardi 29 septembre 2009 à 15:44 +0200, Jerome Benoit a écrit :
> I have a few questions about prelude correlator configuration :
> 
> - Is there a way to define a proxy for DSshield ?

Not at the moment, although you might try the following:

Edit /etc/prelude-correlator/prelude-correlator.conf, and in the
DshieldPlugin section, modify the following:

server = proxy_url
uri = http://www.dshield.org/ipsascii.html?limit=10000

Please let us know if this help.

> - Is there a global documentation on plugins configuration ?

Not at the moment, although most of it is documented in the
prelude-correlator.conf configuration template.


> - Can we filter only correlated event for SMTP nofication ?

You should be able to do this by using a filtering plugin :

[idmef-criteria=myfilter]
rule = alert.correlation_alert.name
hook = smtp[instance_name]

Regards,


-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                       Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user