prelude-lml SNARE ruleset

Hello,

I've created and tested a set of prelude-lml rules for use with SNARE on
Windows.  This series of pcre regex captures important security event logs
and translates them into IDMEF for use with prelude-manager/prewikka.

Make sure you disable the 'SYSLOG HEADERS' option in Snare or else the regex
wont match, or leave headers enabled and adjust the regex.  The headers just
provide redundant information anyway on Windows.

Let me know if you have any comments or questions.  These have been tested
thoroughly, but any recommendations or feedback would be greatly
appreciated.

Thanks!
Nick Nachefski

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user