Commit Graph

12 Commits (b8cf50678fc3bdc932bff13886bbfd1b8ebb0643)

Author SHA1 Message Date
Victor Julien 477bc1d050 Set DROP flag on a packet in addition to the REJECT flags. This makes sure we not only send a reject, but also drop the offending packet. Closes #248. 14 years ago
Pierre Chifflier de41612ea1 Add options to choose if we log header and content in Prelude alert module.
Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
14 years ago
Pierre Chifflier 9a53a09c58 Log verdict in Prelude alert module
Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
14 years ago
Victor Julien 4e7df60b2f Make pcap file mode read multiple packets per 'read'. Update threading model to deal with this. 15 years ago
Gerardo Iglesias Galvan 9f4fae5b1a Fix inconsistent use of dynamic memory allocation 15 years ago
William Metcalf ce01927515 Import of GPLv2 Header 050410 15 years ago
Victor Julien 070ed778b8 Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added. 15 years ago
Victor Julien eeb98c6900 Move SCSetThreadName to proper functions. 15 years ago
Gerardo Iglesias Galvan 9f35a24a1f Set threads name. Fix bug #83 15 years ago
Pierre Chifflier 5535e083a0 Fix prelude init and cleanup sequence using OutputCtx
Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
15 years ago
Pablo Rincon 25a3a5c6d8 Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks. 15 years ago
Pierre Chifflier 4515ae13e4 Add Prelude output plugin
Add support for reporting alerts to the Prelude SIEM system, using
libprelude to send IDMEF (RFC4765) messages.

Each message contains the alert description and reference (using
the SID/GID), and a normalized description (assessment, impact,
sources etc.)

libprelude handles the connection with the manager (collecting component),
spooling and sending the event asynchronously. It also offers transport
security (using TLS and trusted certificates) and reliability (events
are retransmitted if not sent successfully).

This modules requires a Prelude profile to work (see man prelude-admin
and the Prelude Handbook for help).

Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
15 years ago