idmef-criteria help

I haven't been able to use idmef-criteria or thresholding to work for
me at all. I decided to try something that should be fairly simple:
have all alerts from all sensors go into the database, but only have
alerts with a severity of medium or high trigger the smtp plugin.

I first tried this alone:

******************************
[idmef-criteria=low]
rule = alert.assessment.impact.severity == low
hook = db
******************************

But for some reason that causes Prelude Manager to ignore everything
with a high or medium severity. In other words, where I was receiving
messages of any severity both in the database and via smtp before
specifying any idmef-criteria, adding the one line above resulted in
low alerts going into the database and high/medium alerts being
ignored completely: no smtp, no db.  I found that behavior unexpected
(and also undocumented - if a catch-all rule is needed, such is not
stated anywhere in the documentation) but I added a second rule:

******************************
[idmef-criteria=low]
rule = alert.assessment.impact.severity == low
hook = db

[idmef-criteria=medhigh]
rule = alert.assessment.impact.severity == medium
rule = alert.assessment.impact.severity == high
hook = smtp
******************************

The problem created by that second rule? Low severity messages go to
the database, high and medium go to smtp - only - and never get
entered into the database.

I even tried adding two hooks to the second idmef-criteria...

hook=db
hook=smtp

...which Prelude-manager took just fine and started without error, but
then NOTHING goes to the database plugin or the smtp plugin. THIS
SHOULD NOT BE THAT DIFFICULT TO FIGURE OUT.

Thanks in advance to anyone who takes pity on me and takes 3 minutes
of their time to reply with meaningful and helpful information. This
functionality is KEY to properly tuning Prelude (tuning being a method
of making something actually useful in the real world), but the
documentation is very very lacking. When no criteria is specified,
everything is forwarded to all defined plugins, but when ANY criteria
is specified, only the specified criteria is forwarded? Why?
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user