Re: IDMEF Implementations besides Snort?

Hi,

You should reach http://www.prelude-ids.org which is the site of a GNU
IDS project.
This IDS is hybrid (host & network based) and can be distributed easily
all around a big network.
Prelude is very fast and it's difficult to evade from it (whereas many
others IDS are easy to bypass...).
The output is fully IDMEF v6 compliant and is stocked in databases.
You can read thoses databases by using a web frontend that uses IDMEF
tags to show the alerts.

bye,

laurent oudot


"Andrew Hintz (Drew)" wrote:

> Does anyone know of any IDMEF output plugins/converters for existing
> IDSs or loggers, such as RealSecure, NFR, syslog, MS event log, etc?
> The only one that I'm aware of is the Silicon Defense IDMEF output
> plugin for Snort.
>
> Thanks in advance,
> --
> ^Drew
>
> http://guh.nu
>
> --Begin PGP Fingerprint--
> 3C6C F712 0A52 BD33 C518  5798 9014 CA99 2DA0 5E78
> --End PGP Fingerprint--