Prelude Alert Tuning

This is my first post to this list. I've been enjoying "wrestling" with
Prelude for about 2 weeks now. I've tried to get Prelude running on RHEL,
CentOS 5.3, Ubuntu 10.04 & 10.10, and finally (successfully!) on Fedora 14.
I'm very happy today because I finally have Prelude Manager and Prelude LML
installed and working as well as PreWikka and OSSEC. Most of the problems
were due to my lack of understanding of the product, particularly its
configuration.

My next big goal will be a couple of Snort sensors but first I want to
figure out how to tune the system for the most meaningful SMTP alerts. We're
a very small IT shop, and we don't want to know about every single dropped
connection on every single Windows box's firewall, for example. I know I can
do some tuning on OSSEC for the Windows clients, but I know I am going to
need to also be able to set some thresholds and tune out some stuff right in
Prelude. Where do I start?

The first thing I want to "tune out" are the heartbeat emails. I want them
to be logged so that I can view them in PreWikka, but I do not want to
receive an email every time. Right now, with just three sensors or analyzers
running (OSSEC, P-M, P-LML) we're getting   emails way too often, and I
really don't think they're useful in our environment. I know I can set the
heartbeat to a higher interval (currently 600s/10m) but what I really need
to know how to do is to set thresholds for emails vs. just logging.

Thanks!
Chris Hager
Hastings City Bank
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user