| Greetings,
| When will OSSEC send properly formatted IDMEF messages to prelude-ids?
| Currently it appears that OSSEC does not respect the "target" address as
| they continually show up as "N/A" in installs that we've seen.
|
Hello Adriel,
Since in OSSEC source code (prelude.c) there is:
add_idmef_object(idmef, "alert.target(0).Node.Address(0).address",
lf->dstip);
it does not seem to be an issue from the Prelude code point of view. And since
it is the same code for lf->srcip, which works well, I guess there is a
problem with maybe the datastructure not filled correctly.
I actually agree with you, target address is N/A will all alerts I have here.
However this wasn't a real problem since I never care of targets.
I have to see how Ossec fills this field in emails for alerts and see what I
can do to fix this, either in what we have in EventInfo, either in the prelude
code.
Btw, if you have a patch, that is more than welcome ;-)
Thanks for reporting the issue,
Sebastien.
