Re: Prelude alert workflow

Paul Robert Marino wrote:
> well unfortunately you are not the the first person to bring this up. 
> and no the ticket system last i saw it does not solve the problem you 
> are asking about however that was well over two years ago.
> the short coming is actually in the RFC for I.D.M.E.F. that governs 
> the the alert format (http://www.rfc-editor.org/rfc/rfc4765.txt) there 
> was no though put into including operational work flow data in the 
> alert. I've been debating for some time about trying to draft an 
> addendum to the RFC. although I have not had time to write it yet an 
> am unsure as to the process of how to get it adopted as a new RFC.
>
> The simplest solution you can do is what i did, I altered the alerts 
> in the database by add additional data fields to the alert in the 
> database which can be filtered on in and viewed Prewikka.
> unfortunately i can not provide you with the scripts i wrote for this 
> because they were integrated into a fast web interface I wrote against 
> a specific now obsolete version of Prelude-XLR with PostgreSQL for a 
> former employer.
> but if you understand SQL its not very hard to do because the tables 
> are all linked by the alert ID and the names of the tables and fields 
> are fairly self explainitory.
>
> Christopher Byrd wrote:
>> I have set up a working lab for Prelude combined with OSSEC and Snort
>> using the open source version of Prelude.  My question for the list is
>> how are you actually using Prelude in production?  What workflow do
>> you use to review and respond to alerts, especially in multi-analyst
>> environments?
>>
>> Using Prewikka (not Pro) the only method I can find to "handle" an
>> event is to delete it, which I have confirmed will delete the alert
>> entirely from the database.  This would seem to make auditing for
>> review and compliance activities difficult.  In my case, I'd like to
>> find a way to mark the alert as reviewed, hopefully including an
>> optional comment or classification.  Preferably, reviewed alerts would
>> be archived in the database, and only available in reports, or when
>> defined in searches, etc.
>>
>> It may be that the ticket system in Prewikka Pro is the answer,
>> although I still wonder if even the automatic ticket system fully
>> answers the above.  I'm hoping someone has some insight on how this
>> works in the open source version, if it is possible at all.
>>
>> If you are using Prelude/Prewikka in production would you please
>> comment on how you use it as part of your processes?
>>
>> Thanks in advance!
>>
>> Christopher
>> _______________________________________________
>> Prelude-user site list
>> [email protected]
>> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
>>   
>
oh one more thing using the additional data fields for storing this 
information is completely compliant with the existing RFC.
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user