Re: idmef-criteria help

Thank you. I'll give your recommendation a try! I want to add (for
academic reasons) that for some reason, the entry that I have right
now is behaving exactly the way I want it to. It may be the result of
a bug and shouldn't work or might break with a future update, but the
following does exactly the same thing and exactly what I was trying to
accomplish:

[idmef-criteria=3Dseveritymedhigh]
rule =3D alert.assessment.impact.severity !=3D low
hook =3D smtp[default]
hook =3D db[default]

[idmef-criteria=3Dseveritylow]
rule =3D alert.assessment.impact.severity =3D=3D low
hook =3D db[default]



On Tue, Mar 1, 2011 at 4:45 AM, Yoann Vandoorselaere
<[email protected]> wrote:
> Hi Chris,
>
> Le lundi 28 f=E9vrier 2011 =E0 12:02 -0500, Chris Hager a =E9crit :
>> I haven't been able to use idmef-criteria or thresholding to work for
>> me at all. I decided to try something that should be fairly simple:
>> have all alerts from all sensors go into the database, but only have
>> alerts with a severity of medium or high trigger the smtp plugin.
>>
>> I first tried this alone:
>>
>> ******************************
>> [idmef-criteria=3Dlow]
>> rule =3D alert.assessment.impact.severity =3D=3D low
>> hook =3D db
>> ******************************
>>
>> But for some reason that causes Prelude Manager to ignore everything
>> with a high or medium severity.
>
> That's expected : you are setting up a filter saying to pass on only
> events that match the 'alert.assessment.impact.severity =3D=3D low' filter
> to the database plugin. Other events for the database plugin will thus
> be discarded.
>
>
>> In other words, where I was receiving
>> messages of any severity both in the database and via smtp before
>> specifying any idmef-criteria, adding the one line above resulted in
>> low alerts going into the database and high/medium alerts being
>> ignored completely: no smtp, no db. =A0I found that behavior unexpected
>> (and also undocumented - if a catch-all rule is needed, such is not
>> stated anywhere in the documentation) but I added a second rule:
>>
>> ******************************
>> [idmef-criteria=3Dlow]
>> rule =3D alert.assessment.impact.severity =3D=3D low
>> hook =3D db
>>
>> [idmef-criteria=3Dmedhigh]
>> rule =3D alert.assessment.impact.severity =3D=3D medium
>> rule =3D alert.assessment.impact.severity =3D=3D high
>> hook =3D smtp
>> ******************************
>
> In order to have all events going to the prelude database, and only
> medium/high severity events going to the SMTP plugin, only this rule
> should be needed:
>
> [idmef-criteria=3Dmedhigh]
> rule =3D alert.assessment.impact.severity =3D=3D (medium||high)
> hook =3D smtp
>
> Note that 'alert.assessment.impact.severity =3D=3D (medium||high)' is jus=
t a
> quick way of writing 'alert.assessment.impact.severity =3D=3D medium ||
> alert.assessment.impact.severity =3D=3D high'
>
>> The problem created by that second rule? Low severity messages go to
>> the database, high and medium go to smtp - only - and never get
>> entered into the database.
>>
>> I even tried adding two hooks to the second idmef-criteria...
>>
>> hook=3Ddb
>> hook=3Dsmtp
>
> This isn't correct, only one rule / hook can be specified by plugin
> instance.
>
>
> Regards,
>
> --
> Yoann Vandoorselaere | Directeur Technique/CTO | Prelude Technologies
> Tel: +33 (0)1 40 24 65 10 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 Fax: +33 (0=
)1 40 24 65 28
> http://www.prelude-technologies.com
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user