Re: Stack report plugins with idmef-criteria

Hi Sérgio,

Le lundi 14 juin 2010 à 10:37 +0100, Sérgio Alves a écrit :
> Hy there prelude users, do you know if i can do this in the report plugin of prelude-manager?
> 
> [smtp=test_high]
> sender = prelude_high@localhost
> recipients = high@localhost
> smtp-server = localhost
>  
> [idmef-criteria]
> rule = alert.assessment.impact.severity == 'high'
> hook = smtp[test_high]
>  
> [smtp=test_low]
> sender = prelude_low@localhost
> recipients = low@localhost
> smtp-server = localhost
>  
> [idmef-criteria]
> rule = alert.assessment.impact.severity == 'low'
> hook = smtp[test_low]
>  
> When i run with the two criterias prelude send me all the alerts for all
> e-mail accounts.
> Is there a way to make this work?

Since no instance name is provided in each [idmef-criteria] section, a
default instance named "default" is used, which is why the criteria
isn't working. 

Could you please try assigning a different instance name to each
idmef-criteria section, and report whether this fixes your issue?

Regards,

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)1 40 24 65 10                      Fax: +33 (0)1 40 24 65 28
http://www.prelude-technologies.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user