Re: Prelude alert workflow

I have decided to take a different approach at this, using MySQL after
delete triggers to insert deleted rows into an archive database.  This
means that the delete button in the Prewikka interface doesn't really
mean delete - it sends the selected alerts to be archived instead.

Advantages
- Supports limited analyst workflow and reporting on "handled" alerts
- No need to modify Prewikka or Prelude code
- Existing tools work with the archive database (e.g. preludedb-admin)
- An archive is kept of all alerts, even after an analyst deletes them

Disadvantages
- Limited "meta" information on who archived the alert or why

Unknown
- Performance has not been fully evaluated, but falls under "works for me"

Anyone who needs the "meta" information obviously should be looking at
Prewikka Pro for the ticketing functionality.  However, even Prewikka
Pro users may benefit from an alert archive database.

I have posted additional details (including the commands I used to
create the archive database and tables) to my blog at:
http://riosec.com/archiving-prelude-alerts

Please let me know what you think, and suggestions for improvement!

Thanks,

Christopher
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user