> > So the admin would create the rule he wants, create a unique key and tell > > the IDS what the key is and how it should react when it sees a record with > > that key. > > Yes. What I want to do is also say that if you create your unique key a > certain way, you get this additional benefit of realtime alerting or > correlation. if you choose not to, then its treated as any other event
I agree with Steve's compromise with speed, but maybe there's no way out of using hashes or linked lists in the general case. What if a message is important not only for the IDS plugin but also to a fictional 'real-time compliance reporting' plugin - both wanting to use the key field to carry special things, and in the same event: type=USER_ACCT msg=... key=ids-file-high,sox-fault-med,actual_key The plug-ins would need to check if their specific identifier is present not only in the first 4 bytes, but after every comma. If it's desirable to support the general case, instead of putting everything in one single 'key' field, maybe having an index just like execve arguments: type=USER_ACCT msg=... key[0]=ids-file-high key[1]=sox-fault-med key[2]=actual_key Still need to iterate through all keys in the worst case, but the plugins could individually chose between having the rules hardcoded (for speed) or configurable. -Klaus -- Klaus Heinrich Kiwi Security Development - IBM Linux Technology Center -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
