File: NEWS

package info (click to toggle)
prelude-correlator 4.1.1-2
  • links: PTS, VCS
  • area: main
  • in suites: buster
  • size: 1,056 kB
  • sloc: python: 1,686; sh: 34; makefile: 23
file content (620 lines) | stat: -rw-r--r-- 15,972 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
* 2017-10-19, prelude-correlator-4.1.1:

Author: Antoine Luong

- Fix context destruction while iterating



* 2017-07-21, prelude-correlator-4.1.0:

Author: Thomas Andrejak

- Add support for key:value out of a config section

Author: Antoine Luong

- Avoid displaying a traceback



* 2017-07-13, prelude-correlator-4.1.0rc2:

Author: Antoine Luong

- Allow passing prelude-specific options in configuration



* 2017-06-30, prelude-correlator-4.1.0rc1:
* 2017-06-23, prelude-correlator-4.1.0beta2:
* 2017-06-16, prelude-correlator-4.1.0beta1:

No new changes.



* 2017-02-16, prelude-correlator-4.0.0:

No new changes.



* 2017-02-12, prelude-correlator-4.0.0rc3:

Author: Thomas Andrejak

- Fix Python 3 compatibility

Author: Camille Gardet

- Fix CIArmy config keyword



* 2017-02-03, prelude-correlator-4.0.0rc2:

Author: Song Tran

- Add INSTALL file



* 2017-01-27, prelude-correlator-4.0.0rc1:
* 2017-01-12, prelude-correlator-4.0.0beta2:
* 2016-12-23, prelude-correlator-4.0.0beta1:

No new changes.



* 2016-09-14, prelude-correlator-3.1.0:
* 2016-09-01, prelude-correlator-3.1.0rc3:
* 2016-08-19, prelude-correlator-3.1.0rc2:

No new changes.



* 2016-08-05, prelude-correlator-3.1.0rc1:

Author: Antoine Luong

- Prevent potential import errors when loading contexts

- Rename analyzer model to 'Prelude Correlator'

- Minor fixes in exception handling

Author: Thomas Andrejak

- Make the context able to access plugins

- Disable flatten when getting alert.source(*) in BruteForce

- Missing import in prelude-correlator plugin manager

Author: Abdel Elmili

- Add --profile option to prelude-correlator

    The goal of adding this option is to allow operators to run more than
    one correlator on the same host. Each correlator will use a different
    profile.

Author: Sélim Menouar

- Clearly separate File and IDMEFClient inputs



* 2016-04-22, prelude-correlator-3.0.0:

No new changes.



* 2016-04-15, prelude-correlator-3.0.0rc4:

Author: François Poirotte

- Re-enable SpamHaus plugin & add warning



* 2016-04-08, prelude-correlator-1.3.0rc3:

Author: Thomas Andrejak

- Add CIArmy blacklist like DShield or Spamhaus

- Fix download() with text/plain files



* 2016-04-01, prelude-correlator-1.3.0rc2:

Author: Yoann Vandoorselaere

- Fix incorrect aggregation in some corner case

Author: François Poirotte

- Single alert for hosts with multiple IPs



* 2016-03-25, prelude-correlator-1.3.0rc1:

Author: Yoann Vandoorselaere

- Pickle compatibility for IDMEF object

Author: Louis-David Gabet

- Comment python_rules section by default



* 2016-03-18, prelude-correlator-1.3.0beta2:

Author: Louis-David Gabet

- Fix 'python_rules' section error

Author: Thomas Andrejak

- Fix wrong access to entrypoint name



* 2016-03-01, prelude-correlator-1.3.0beta1:

Author: Song Tran

- Add additional SELinux policies

Author: Thomas Andrejak

- Load plugins from entrypoints and directories

- The README in conf.d was not the right file

- Change prelude-ids.com to prelude-siem.com



* 2016-01-11, prelude-correlator-1.3.0alpha1:

Author: Louis-David Gabet

- Add include section to configuration file
  to allow independent configuration files for plugins

Author: Antoine Luong

- Correct download address parameter in conf

Author: Song Tran

- Add SELinux policy for prelude-correlator



* 2015-07-31, prelude-correlator-1.2.6:

No new changes.



* 2015-07-27, prelude-correlator-1.2.6rc5:

Author: Antoine Luong

- Disable SpamhausDrop rule by default

- Add the -D shortcut for debug mode, to be consistent with other Prelude modules

- Update dshield.dat and spamhaus_drop.dat



* 2014-10-27, prelude-correlator-1.2.6rc4:

Author: Yoann Vandoorselaere

- Reset IDMEF CreateTime when sending an alert

- Fix possible exception in case of download failure

- Minor fixes



* 2014-09-23, prelude-correlator-1.2.6rc2:

Author: Yoann Vandoorselaere

- Rework exception flow

- Verify plugin enable/disable attribute before entrypoint loading

    Allow the user to disable a plugin before the entrypoint is called
    (useful if the plugin entrypoint triggers, for example, an exception).

- Remove semi broken EGG support for now, improve require API for future use

- Namespace support

- Corrected permissions checking

- Remove uppercase from package name, as specified in PEP8

- Update for latest libprelude bindings API changes

    High level bindings in libprelude are now the standard, and got renamed
    from "PreludeEasy" to "prelude". Method names were also renamed.

- Python3 compatibility work



* 2014-09-16, prelude-correlator-1.2.6rc1:

Author: Yoann Vandoorselaere

- Fix problem with --root installation, and --prefix=/

- Syslog logging fallback to UDP localhost if no socket is found

- Various timer fixes

    - Timers added multiple times on reset

    - Timers with negative expiration time not initialized correctly

    - Unnecessary traversal of the timer list on reset

- Introduce a new DownloadCache, used by Dshield and Spamhaus plugin

- Prevent traceback on profile error



* 2014-07-07, prelude-correlator-1.2.5:

- Improved exception handling

- Support IDMEF Alert merge, to avoid CorrelationAlert listing
  the same source multiples times

- Allow pluginmanager API to be used with multiples entrypoints

    A Prelude-Correlator plugin may now use the pluginmanager API with
    their own entrypoint to load their own sub-plugins.

- Allow plugin to specify a list of conflicting plugins

    Using this interface, a plugin can now provide a list of other plugins
    that conflict with him, and that shouldn't be loaded.
    Additionally, provide a way for the user to force loading of a plugin
    that was disabled because of a conflict (using enable = force in the
    configuration section for the plugin).

- Add autoload attribute to the generic Plugin class

    This attribute controls whether PluginManager() will directly load a given
    plugin or only references the plugin class for later loading. Default behavior
    is to load the plugins.

- Various timer improvements

- Add an option to read IDMEF input from file,
  within the given offset / limit

- Add a stats() function which can be used by a plugin
  to provide statistics printing

- Implement GetAdditionalDataByMeaning() method

- Always retrieve the current time when no argument is supplied

- Add --disabledl option to setup.py sdist
  Downloading Spamhaus database need real user-agent, using Mozilla 5

- Logging fixes, using Python logging API

- Add the ability to set debug log level

- Updated dshield.dat, spamhaus_drop.dat

- Removed rhel6 packaging



* 2013-09-20, prelude-correlator-1.0.2:

- setup.py : Fixed files downloading behind proxies

- RHEL : Added missing dependency to python-setuptools

- RHEL : Fixed #517 : Prelude Correlator not starting (SELinux)

- RHEL : Fixed #494 : Prelude Correlator not stopping

- Added some debug infos


* 2012-06-01, prelude-correlator-1.0.1:

- Fixed #494 : Prelude Correlator not stopping

- Changed Copyright

- Added packaging for rhel6

- Ability to specify an input IDMEF criteria

  There is now a [general] configuration section in prelude-correlator.conf
  allowing to specify a criteria option that use an IDMEF criteria parameter
  as an argument.
    
  Using this option, it is possible to specify an input filter for events
  to be processed by the correlator.
    
  Additionally, always use an IDMEFCriteria to check whether the input
  event is an alert, in place of manually retrieving alert.create_time.

- Fixed some typo

- Implement Context time merging capability
    
  Introduced time merging capability within Prelude-Correlator:
  as of now, correlation contexts are associated with the time of the
  triggering IDMEF event.
    
  When searching for a matching context, an existing context will only be
  returned in case the specified search time match the time windows of an
  existing context.
    
  This mean that when receiving a burst of events, the time carried with
  events is directly taken into account : separate instances exists for
  the same Context associated with events received at a different time.
    
  Additionally, context can be merged if more than one context time windows
  overlap.


* 2010-03-16, prelude-correlator-1.0.0:

- When Prelude-Correlator is started as a daemon, make sure we use
  syslog for logging.

- Fix an exception when adding an alert with no source or target to the
  generated Correlation alert, by Frédéric Yhuel
  <fyhuel@prelude-technologies.com>

- Do not generate Brute Force CorrelationAlert for multiples successful
  authentication.

- Workaround documentation installation problem.


* 2010-03-08, prelude-correlator-1.0.0rc4:

- Fix installation problem (#372).


* 2010-03-05, prelude-correlator-1.0.0rc3:

- Prelude-Correlator wasn't properly updating context (and thus, didn't
  generate correlation events) since context identifiers were escaped
  twice.

- Prevent exception when Prelude-Correlator attempt to restore contexts
  from an earlier Prelude-Correlator version, and that the context
  internal attributes have changed.

- A sample-plugin example has been included in the distribution.


* 2010-02-01, prelude-correlator-1.0.0rc2:

- Fix generated tarball name, so that the package might easily be
  included in various distribution for testing.


* 2010-01-29, prelude-correlator-1.0.0rc1:

- [Firewall]: The plugin will now report CorrelationAlert for events /
  sets of events that appear to have passed through a firewall known to
  protect the target machine. If no firewall ever emit block concerning
  a given host, then this host is considered un-protected, and there is
  no point in reporting CorrelationAlert.

- [OpenSSHAuth]: The plugin has been modified so that it can now
  generate a single CorrelationAlert for multiples authentication method
  used in a given time slice.

- [Spamhaus]: The plugin has been modified so that it can now generate a
  single CorrelationAlert for multiples events received from the same
  source.

- [BruteForce]: Various improvement, do not limit the number of events
  the plugin is able to report in a single CorrelationAlert.

- [Scan]: do not limit the number of events the plugin is able to report
  in a single CorrelationAlert.

- Context initialization now take an optional 'overwrite' argument. This
  argument, if set to False, mean that the Context() will be returned
  un-modified if it already exist. If it doesn't, it will be created.

- New Context.update() method, which provide exactly the same
  functionality as calling Context() with the 'update=True' argument.
  This is useful since some plugin need to defer an update to another
  place in the code.

- If the context creation/update function is called with an IDMEF message
  parameter, then we automatically call addAlertReference on the context
  CorrelationAlert using the provided message as the parameter.

- Make it possible to change context option on update

- Automatically set CorrelationAlert DetectTime : reported
  CorrelationAlert DetectTime now match the time of the first event that
  was detected.

- Make it possible for plugin to specify a function to be called on
  Timer expiration.

- Disable BusinessHour correlation by default since it is very verbose

- Various bug fixes.


* 2009-11-03, prelude-correlator-0.9.0-beta8:

- Include spamhaus_drop.dat in the source distribution. Fix installation
  issue (closes #364).


* 2009-11-02, prelude-correlator-0.9.0-beta7:

- Initial SpamhausDrop plugin implementation, by
  Wes Young <wes@barely3am.com> (closes #363)

- Do not discard --root parameters if prefix is absolute.

- Python 2.4 backward compatibility fixes.

- Handle plugin loading error gracefully.

- Improve WormPlugin accuracy, and make it carry a reference to the
  initial event. The plugin used to alert when seeing an alert to a
  given target, and this same alert going back to the source. This can
  happen in a number of case (example: Netbios alert triggered by Snort)

  As of now, the plugin will wait for the events to be repeated against
  at least 5 differents hosts.

- Dshield CorrelationAlert now handle multiples events. Previously, we
  used to generate a single Dshield CorrelationAlert for each events
  where the source address would match the Dshield database. The plugin
  now generate CorrelationAlert for multiples events received from the
  same source.


* 2009-07-09, prelude-correlator-0.9.0-beta6:

- Provide a default configuration file, and fixes the prelude-correlator
  --config option.

- A rare exception could occur when IDMEF:Set() was called with
  an empty list/tuple as the value argument.

- Normalize libprelude logging through our own log callback (only
  enabled if libprelude >= 0.9.24 is installed).

- The DShield plugin didn't report any events since address loaded
  from the DShield database weren't correctly normalized.

- Automatic download + reloading of the DShield database was fixed.

- DShield generated alerts now include additional details.

- Make it possible to specify your own DShield database file, and to
  prevent automatic download. This is useful on system with no direct
  internet access.

- Handle both standard installation, and EGG installation method (in EGG
  mode, configuration and data files are self contained).

- Introduce a new plugin logging mechanism.

- Add some utility method to the Timer class.

- Make it possible for plugin to define a 'signal' method that will
  get called when prelude-correlator handle a signal (can be used to
  perform special handling before exit, statistics or debugging
  purposes).


* 2009-06-18, prelude-correlator-0.9.0-beta5:

- A bug prevented prelude-correlator from starting in daemon mode when
  using the '--pidfile' option. Fixes #355.

- Prevent prelude-correlator from abording if a plugin fail. Emit
  a warning explaining why a given plugin couldn't load, and continue
  processing.

- Implement a timeout for Dshield.org server connection. The default
  is 10 seconds, and might be modified from the prelude-correlator.conf
  configuration file. This prevent Dshield host list loading from
  blocking forever, and fixes #353.

- Make it possible to disable plugin (fixes #354), by adding the following setting
  in prelude-correlator.conf:

  [PluginClassName]
  disable = true

- Read plugin configuration from prelude-correlator.conf

- Use the Python logging facility.

- Correct copyright notice, add missing AUTHORS, COPYING, HACKING.README files.



* 2009-06-17, prelude-correlator-0.9.0-beta4:

- Initial Python Correlator version. Rationale for the switch available here:
  http://lists.prelude-ids.org/pipermail/prelude-user/2009-April/005163.html

- Support DShield <http://www.dshield.org/> correlation!


* 2008-07-11, prelude-correlator-0.9.0-beta3:

- Add missing AUTHORS file.

- Allow setting 'nil' IDMEF value using IDMEF:set() (#297).

- Fix ctx:set() typo in the business-hour.lua rulese (#297).


* 2008-07-03, prelude-correlator-0.9.0-beta2:

- Fix issues with the business-hour ruleset, that tried updating a non
  existing context. This rule does not need a context at all, rather a
  simple IDMEF object is sufficiant.

- Always return a table when retrieving multiple path (even
  with empty path). Fix #295.

- Correct multi-path detection (was not working with exactly two IDMEF
  path).

- Fix invalid installation path under certain conditions, thanks
  to Steve Grubb <sgrubb@redhat.com> for pointing that out.


* 2008-06-27, prelude-correlator-0.9.0-beta1b:

- Fix invalid installation path under certain conditions.


* 2008-06-27, prelude-correlator-0.9.0-beta1a:

- Always use $(DESTDIR) when installing files.

- Check for lua.pc as well as lua5.1.pc, since different distribution
  seems to be using different default.


* 2008-06-27, prelude-correlator-0.9.0-beta1:

- First Prelude-Correlator release.