1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
# This is a template configuration file for prelude-correlator
#
include = /etc/prelude/default/idmef-client.conf
[general]
#
# Only attempt to correlate input events that match the following criteria:
# criteria =
#
# Only correlate input events sharing the same value for the following path.
# Note that this feature should be used with caution, as the number of
# contexts will rise with the number of different existing values.
# grouping =
# Plugin configuration:
#
# [BruteForcePlugin]
# disable = false
#
# Disable BusinessHour correlation by default since it is very verbose
[BusinessHourPlugin]
disable = true
#
# [OpenSSHAuthPlugin]
# disable = false
#
# [EventScanPlugin]
# disable = false
#
# [EventStormPlugin]
# disable = false
#
# [EventSweepPlugin]
# disable = false
#
# [WormPlugin]
# disable = false
# repeat-target = 5
#
# [CIArmyPlugin]
# disable = false
#
# How often in seconds the CIArmy database should be reloaded (download + reload)
# (default: once a week). 0 to disable reloading.
# reload = 604800
#
# The address to load the CIArmy database from:
# uri = http://cinsscore.com/list/ci-badguys.txt
#
# Define the maximum allowed time for downloading the database
# timeout = 10
#
# Define the path to the database file
# filename = /var/lib/prelude-correlator/prelude-correlator/ciarmy.dat
#
# [DshieldPlugin]
# disable = false
#
# How often the Dshield database should be reloaded (download + reload)
# (default: once a week). 0 to disable reloading.
# reload = 604800
#
# The address to load the Dshield database from:
# uri = http://www.dshield.org/ipsascii.html?limit=10000
#
# Define the maximum allowed time for downloading the database
# timeout = 10
#
# Define the path to the database file
# filename = /var/lib/prelude-correlator/prelude-correlator/dshield.dat
# [SpamhausDropPlugin]
#
# Note: the python-netaddr package is required for this plugin to work.
# Also, versions 0.7.10 to 0.7.15 (inclusive) are known to be very slow
# due to a bug in python-netaddr.
# See https://github.com/drkjam/netaddr/issues/94 for more information
#
# disable = true
#
# How often the Spamhaus database should be reloaded (download + reload)
# (default: once a week). 0 to disable reloading.
# reload = 604800
#
# The address to load the Spamhaus database from:
# uri = http://www.spamhaus.org/drop/drop.txt
#
# Define the maximum allowed time for downloading the database
# timeout = 10
#
# Define the path to the database file
# filename = /var/lib/prelude-correlator/prelude-correlator/spamhaus_drop.dat
#
# This plugin will report CorrelationAlert for events / sets of events
# that appear to have passed through a firewall known to protect the
# target machine.
#
# If no firewall ever emit block concerning a given host, then this host
# is considered un-protected, and there is no point in reporting
# CorrelationAlert.
#
# The 'flush-protected-hosts' variable allow you to define how much
# time a given target hosts should be considered as protected when a
# firewall drop is noticed for this machine.
#
# The plugin is disabled by default since it tend to be very verbose
[FirewallPlugin]
disable = True
flush-protected-hosts = 3600
# [python_rules]
# Python rules folder
# paths = /etc/prelude-correlator/rules/python
# Logging configuration might also be defined in this file:
# http://docs.python.org/library/logging.html
# Include additional configuration files
[include]
conf.d/*.conf
|
