Hi Adriel and Sebastien, I think I know what is going on. We only set the destination IP when it is present in the log itself. So, for a sshd message like:
Apr 24 00:00:02 enigma sshd[10115]: Accepted publickey for xyz from 192.168.2.10 port 6427 ssh2 It would have no dstip. My suggestion (code-wise) would be to set the Prelude target address to the hostname or agent ip addresss.... What do you think? Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Thu, Apr 24, 2008 at 11:38 AM, Adriel Desautels <[EMAIL PROTECTED]> wrote: > Sebastien, > Thank you for such a quick response. This problem is one that my > engineers and customers have been complaining about for a while now. The > ability to view targets for specific attacks is particularly useful when > correlating events. Thanks in advance and if you could keep me posted as > to the fix status that would also be appreciated. > > > Regards, > Adriel T. Desautels > Chief Technology Officer > Netragard, LLC. > Office : 617-934-0269 > Mobile : 617-633-3821 > http://www.linkedin.com/pub/1/118/a45 > > Join the Netragard, LLC. Linked In Group: > http://www.linkedin.com/e/gis/48683/0B98E1705142 > > --------------------------------------------------------------- > Netragard, LLC - http://www.netragard.com - "We make IT Safe" > Penetration Testing, Vulnerability Assessments, Website Security > > Netragard Whitepaper Downloads: > ------------------------------- > Choosing the right provider : http://tinyurl.com/2ahk3j > Three Things you must know : http://tinyurl.com/26pjsn > > > > > Sebastien Tricaud wrote: > > | Greetings, > > | When will OSSEC send properly formatted IDMEF messages to > prelude-ids? > > | Currently it appears that OSSEC does not respect the "target" > address as > > | they continually show up as "N/A" in installs that we've seen. > > | > > > > Hello Adriel, > > > > Since in OSSEC source code (prelude.c) there is: > > add_idmef_object(idmef, "alert.target(0).Node.Address(0).address", > > lf->dstip); > > > > it does not seem to be an issue from the Prelude code point of view. And > since > > it is the same code for lf->srcip, which works well, I guess there is a > > problem with maybe the datastructure not filled correctly. > > > > I actually agree with you, target address is N/A will all alerts I have > here. > > However this wasn't a real problem since I never care of targets. > > > > I have to see how Ossec fills this field in emails for alerts and see what > I > > can do to fix this, either in what we have in EventInfo, either in the > prelude > > code. > > > > Btw, if you have a patch, that is more than welcome ;-) > > > > > > Thanks for reporting the issue, > > Sebastien. > > > > >
