Re: idmef-criteria help

I'd have to guess  and say probably not, because I'm not even sure
what that means.

On Mon, Feb 28, 2011 at 12:02 PM, Chris Hager <[email protected]> wrote:
> I haven't been able to use idmef-criteria or thresholding to work for
> me at all. I decided to try something that should be fairly simple:
> have all alerts from all sensors go into the database, but only have
> alerts with a severity of medium or high trigger the smtp plugin.
>
> I first tried this alone:
>
> ******************************
> [idmef-criteria=3Dlow]
> rule =3D alert.assessment.impact.severity =3D=3D low
> hook =3D db
> ******************************
>
> But for some reason that causes Prelude Manager to ignore everything
> with a high or medium severity. In other words, where I was receiving
> messages of any severity both in the database and via smtp before
> specifying any idmef-criteria, adding the one line above resulted in
> low alerts going into the database and high/medium alerts being
> ignored completely: no smtp, no db. =A0I found that behavior unexpected
> (and also undocumented - if a catch-all rule is needed, such is not
> stated anywhere in the documentation) but I added a second rule:
>
> ******************************
> [idmef-criteria=3Dlow]
> rule =3D alert.assessment.impact.severity =3D=3D low
> hook =3D db
>
> [idmef-criteria=3Dmedhigh]
> rule =3D alert.assessment.impact.severity =3D=3D medium
> rule =3D alert.assessment.impact.severity =3D=3D high
> hook =3D smtp
> ******************************
>
> The problem created by that second rule? Low severity messages go to
> the database, high and medium go to smtp - only - and never get
> entered into the database.
>
> I even tried adding two hooks to the second idmef-criteria...
>
> hook=3Ddb
> hook=3Dsmtp
>
> ...which Prelude-manager took just fine and started without error, but
> then NOTHING goes to the database plugin or the smtp plugin. THIS
> SHOULD NOT BE THAT DIFFICULT TO FIGURE OUT.
>
> Thanks in advance to anyone who takes pity on me and takes 3 minutes
> of their time to reply with meaningful and helpful information. This
> functionality is KEY to properly tuning Prelude (tuning being a method
> of making something actually useful in the real world), but the
> documentation is very very lacking. When no criteria is specified,
> everything is forwarded to all defined plugins, but when ANY criteria
> is specified, only the specified criteria is forwarded? Why?
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user