Configure prelude-lml with snare agent for windows

Hi,

I recently deployed an IDS using prelude and OSSEC. I was now trying to
configure prelude-lml as my syslog server. I found a software called snare
that allowed sending the windows event logs to prelude-lml (if you know any
software better for this puorpose than snare, please tell me) .

I set the snare agent to send the logs to the server where prelude-lml was
configured via UDP. Through a iptables log policy I was able to see that the
snare agent was in fact sending the info to the desired port on the prelude
server.

Now the problem is that there aren't any events on prewikka regarding
prelude-lml.

In the prelude-lml.conf I put the following config regarding snare:

[format=syslog]
time-format = "%b %d %H:%M:%S"
prefix-regex = "^(?P<timestamp>.{15}) (?P<hostname>\S+)
(?:(?P<process>\S+?)(?:\[(?P<pid>[0-9]+)\])?: )?"
udp-server = 0.0.0.0:6161

Is this correct or am I missing something?

Thanks in advance,

Hugo Ferreira
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user