Re: Payload in email?

Yoann Vandoorselaere <[email protected]> Fri, 26 Feb 2010 16:02:44 +0100

Newsgroups	gmane.comp.security.ids.prelude.user
Message-ID	<1267196564.15286.214.camel@arwen>

Hi,

Le mardi 23 février 2010 à 11:54 -0500, agentgreen a écrit :
> Actually I found the IDMEF path for this 
> ($alert.additional_data(23).data in my case), but its not decrypted. Is 
> it possible to get the decrypted payload and send that to SMTP?

This is not possible at the moment: AdditionalData of type "byte-string"
are currently written out base64 encoded.

Eventually, it will be possible to develop some features allowing to
provide an hexadecimal or ASCII dump instead of the current base64
output.

You might want to add a request for this functionality on the
development tracker:

https://dev.prelude-technologies.com/projects/prelude-manager

Regards,

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)1 40 24 65 10                      Fax: +33 (0)1 40 24 65 28
http://www.prelude-technologies.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user