Sebastien,
Thank you for such a quick response. This problem is one that my
engineers and customers have been complaining about for a while now. The
ability to view targets for specific attacks is particularly useful when
correlating events. Thanks in advance and if you could keep me posted as
to the fix status that would also be appreciated.
Regards,
Adriel T. Desautels
Chief Technology Officer
Netragard, LLC.
Office : 617-934-0269
Mobile : 617-633-3821
http://www.linkedin.com/pub/1/118/a45
Join the Netragard, LLC. Linked In Group:
http://www.linkedin.com/e/gis/48683/0B98E1705142
---------------------------------------------------------------
Netragard, LLC - http://www.netragard.com - "We make IT Safe"
Penetration Testing, Vulnerability Assessments, Website Security
Netragard Whitepaper Downloads:
-------------------------------
Choosing the right provider : http://tinyurl.com/2ahk3j
Three Things you must know : http://tinyurl.com/26pjsn
Sebastien Tricaud wrote:
> | Greetings,
> | When will OSSEC send properly formatted IDMEF messages to
> prelude-ids?
> | Currently it appears that OSSEC does not respect the "target" address as
> | they continually show up as "N/A" in installs that we've seen.
> |
>
> Hello Adriel,
>
> Since in OSSEC source code (prelude.c) there is:
> add_idmef_object(idmef, "alert.target(0).Node.Address(0).address",
> lf->dstip);
>
> it does not seem to be an issue from the Prelude code point of view. And since
> it is the same code for lf->srcip, which works well, I guess there is a
> problem with maybe the datastructure not filled correctly.
>
> I actually agree with you, target address is N/A will all alerts I have here.
> However this wasn't a real problem since I never care of targets.
>
> I have to see how Ossec fills this field in emails for alerts and see what I
> can do to fix this, either in what we have in EventInfo, either in the prelude
> code.
>
> Btw, if you have a patch, that is more than welcome ;-)
>
>
> Thanks for reporting the issue,
> Sebastien.
>
>
begin:vcard
fn:Adriel T Desautels
n:Desautels;Adriel T
org:Netragard, LLC.
adr:;;17 Sheldon Road;Mendham ;NJ;;USA
email;internet:[EMAIL PROTECTED]
title:Chief Technology Officer
tel;work:617-934-0269
tel;cell:617-633-3821
x-mozilla-html:FALSE
url:http://www.netragard.com
version:2.1
end:vcard
