prelude-lml filter format

I'm attempting to write a prelude-lml log format rule for windows snare
events and I need a second pair of eyes on this.

The reason i'm doing this is because "Detect Time" and "Analyzer Time" are
showing up as the same in prelude, but are obviously two different
timestamps(see the LOG below).

The first time stamp is the "Analyzer Time", which is the timestamp SNARE
puts on the event(*- year*).  The second is the time that Windows stamps
into the actual event log(*+ year*), in my opinion this should be the
"Detect Time".

In my prelude manager, I'm only getting the first time stamp(snare) for all
three fields(Create time, Detect time, Analyzer time)

<snip from prelude-lml.conf>
#LOG: *Nov 24 12:44:43* 10.1.1.2 testbox01        MSWinEventLog   1
Security        154     Tue *Nov 24 12:44:36 2009*
[format=snare_windows]
time-format = "%b %d %H:%M:%S %Y"
prefix-regex = "\w{3} \d{1,2}
\d\d:\d\d:\d\d\s+\S*\s*(?P<hostname>\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d+\s+\w+(?P<timestamp>.{20})"
file = /log/remote/windows/event.log

But, when i load this rule up i get the following from prelude-lml:

*prelude-lml: WARNING: no appropriate format defined for log entry:*

The time-format is definitely OK,
*# date +"%b %d %H:%M:%S %Y"
Nov 24 13:15:27 2009
*
and the prefix-regex matches when i put it though a perl interpreter, just
not in my prelude-lml.conf.
Also, i'm not sure what '?P' is, but i think it may be a custom tag used by
LML to identify IDMEF content.

Any help would be greatly appreciated.

-Nick
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user