Re: Prelude alert workflow

simple way is to setup an instance of RTIR, have prelude mail the  
messages to that and use it as your ticketing workflow. RTIR allows  
you to map your 'process' a bit easier when it comes to workflow.

We use prelude to "do the work" and RTIR to "track the workflow". They  
work well together.

On Dec 2, 2009, at 8:54 PM, Paul Robert Marino wrote:

> Paul Robert Marino wrote:
>> well unfortunately you are not the the first person to bring this up.
>> and no the ticket system last i saw it does not solve the problem you
>> are asking about however that was well over two years ago.
>> the short coming is actually in the RFC for I.D.M.E.F. that governs
>> the the alert format (http://www.rfc-editor.org/rfc/rfc4765.txt)  
>> there
>> was no though put into including operational work flow data in the
>> alert. I've been debating for some time about trying to draft an
>> addendum to the RFC. although I have not had time to write it yet an
>> am unsure as to the process of how to get it adopted as a new RFC.
>>
>> The simplest solution you can do is what i did, I altered the alerts
>> in the database by add additional data fields to the alert in the
>> database which can be filtered on in and viewed Prewikka.
>> unfortunately i can not provide you with the scripts i wrote for this
>> because they were integrated into a fast web interface I wrote  
>> against
>> a specific now obsolete version of Prelude-XLR with PostgreSQL for a
>> former employer.
>> but if you understand SQL its not very hard to do because the tables
>> are all linked by the alert ID and the names of the tables and fields
>> are fairly self explainitory.
>>
>> Christopher Byrd wrote:
>>> I have set up a working lab for Prelude combined with OSSEC and  
>>> Snort
>>> using the open source version of Prelude.  My question for the  
>>> list is
>>> how are you actually using Prelude in production?  What workflow do
>>> you use to review and respond to alerts, especially in multi-analyst
>>> environments?
>>>
>>> Using Prewikka (not Pro) the only method I can find to "handle" an
>>> event is to delete it, which I have confirmed will delete the alert
>>> entirely from the database.  This would seem to make auditing for
>>> review and compliance activities difficult.  In my case, I'd like to
>>> find a way to mark the alert as reviewed, hopefully including an
>>> optional comment or classification.  Preferably, reviewed alerts  
>>> would
>>> be archived in the database, and only available in reports, or when
>>> defined in searches, etc.
>>>
>>> It may be that the ticket system in Prewikka Pro is the answer,
>>> although I still wonder if even the automatic ticket system fully
>>> answers the above.  I'm hoping someone has some insight on how this
>>> works in the open source version, if it is possible at all.
>>>
>>> If you are using Prelude/Prewikka in production would you please
>>> comment on how you use it as part of your processes?
>>>
>>> Thanks in advance!
>>>
>>> Christopher
>>> _______________________________________________
>>> Prelude-user site list
>>> [email protected]
>>> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
>>>
>>
> oh one more thing using the additional data fields for storing this
> information is completely compliant with the existing RFC.
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user

--
Wes
http://claimid.com/wesyoung

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user