Hello,

Once the manager receives and idmef alert form a sensor/correlator I would like to print it in a log file in xml format. To do so there is the XmlMod plugin, but when I uncomment it from prelude-manager.conf and I run it, it says:

/usr/local/etc/prelude-manager/prelude-manager.conf:193: invalid section : "XmlMod".
/usr/local/etc/prelude-manager/prelude-manager.conf:213: invalid option "logfile" in "global" section.
/usr/local/etc/prelude-manager/prelude-manager.conf:214: invalid option "logfile" in "global" section.

Is this correct?

[XmlMod]
#
# The Xmlmod plugin allows to report alerts as IDMEF XML in a file,
# or to dump these alerts to /dev/stdout.
#
# The default behavior is to write output to /dev/stdout.
#
# Tells Xmlmod to disable output file buffering.
# This will prevent XML alerts to be truncated and thus make real-time
# parsing easier:
#
# disable-buffering
#
#
# Tells Xmlmod to check generated XML against IDMEF DTD:
# validate
#
# Tells Xmlmod to produce a pretty, human-readable xml output:
# format
#
logfile = /dev/stdout
logfile = /var/log/prelude-xml.log

Is there anything else needed to allow this plugin?

Another question I would like to ask is if there is any way of writing a prelude-correlator python rule that once a imdef is generated it writes that alert in a json format. I've seen that according to libidmef it is possible

https://github.com/Prelude-SIEM/libidmef

It says:

The print functions allow you to export IDMEF as :
- pretty print stdout
- JSON string
- Binary string defined by libPrelude

But I cannot find a complete documentation of libPrelude, libidmef nor preludecorrelator in order to develop some rules. I would be very grateful if anyone can refer me to a good documentation.

Thank you

Steven