Re: Stack report plugins with idmef-criteria

Thanks for the quick reply, it's working now :)

BTW, openbsd + snort + prelude users that experience problems of
performance can install barnyard2 and connect it to prelude a let snort
log to binary and by2 read log and tell prelude.

Yoann Vandoorselaere wrote:
> Hi Sérgio,
>
> Le lundi 14 juin 2010 à 10:37 +0100, Sérgio Alves a écrit :
>   
>> Hy there prelude users, do you know if i can do this in the report plugin of prelude-manager?
>>
>> [smtp=test_high]
>> sender = prelude_high@localhost
>> recipients = high@localhost
>> smtp-server = localhost
>>  
>> [idmef-criteria]
>> rule = alert.assessment.impact.severity == 'high'
>> hook = smtp[test_high]
>>  
>> [smtp=test_low]
>> sender = prelude_low@localhost
>> recipients = low@localhost
>> smtp-server = localhost
>>  
>> [idmef-criteria]
>> rule = alert.assessment.impact.severity == 'low'
>> hook = smtp[test_low]
>>  
>> When i run with the two criterias prelude send me all the alerts for all
>> e-mail accounts.
>> Is there a way to make this work?
>>     
>
> Since no instance name is provided in each [idmef-criteria] section, a
> default instance named "default" is used, which is why the criteria
> isn't working. 
>
> Could you please try assigning a different instance name to each
> idmef-criteria section, and report whether this fixes your issue?
>
> Regards,
>
>   

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user