Re: prelude-lml SNARE ruleset

Hi Nicholas,

Le lundi 23 novembre 2009 à 14:05 -0600, Nicholas Nachefski a écrit :
> here is the ruleset, attached.....

Thanks for the contribution! Here is a short review:


- The rules shouldn't attempt to match the syslog header, since this
part might vary depending on user configuration. 

This is why we provides the ability to customize the syslog header
matching in prelude-lml.conf. Prelude-LML will then automatically assign
matched field to the relevant IDMEF members. The part of the rule that
matches "Nov 23 12:36:59 10.1.1.1 testbox01" should be removed.


- For the same reason, the rule shouldn't try to match the beginning of
the line (since it might vary depending on syslog server configuration).


- The part of the rules that match network address is IPv4 specific:
Source Network Address: (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

For compatibility with IPv4 and IPv6 devices, we advise using:
Source Network Address: (\S+)


- The classification should match classifications used in other rulesets
(we are in the process of standardizing classification usage). Right now
we use Login / Remote Login. You might take a look at the classification
used in ssh.rules / su.rules / pam.rules as an example.


- Please add your copyright at the top of the file.


This is great work! Could you please provide us with an updated ruleset,
that we will include in the default Prelude-LML distribution ?

Thanks!

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                       Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user