UNITY 360: Issueshttp://www.prelude-siem.org/http://www.prelude-siem.org/welcome/themes/prelude/favicon/Prelude-icon.png2017-09-21T16:38:48ZUNITY 360
Redmine Prelude Correlator rules - Tache #907 (New): CVE-2017-9798 - OptionsBleed - Correlationhttp://www.prelude-siem.org/issues/9072017-09-21T16:38:48ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>Options Bleed is a simple OPTIONS request, there is no specific patterns. But, to gather enough leaked piece of information to make a full one, the attacker need to request OPTIONS many time.</p> Prelude-LML - Bug #872 (New): Prelude-LML check not workinghttp://www.prelude-siem.org/issues/8722017-01-28T18:26:52ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>Since we move rules to another subproject (prelude-lml-rules), make check is not working. Error in "tests" folder.</p> PRELUDE SIEM - Bug #870 (New): prelude-lml /etc permissionshttp://www.prelude-siem.org/issues/8702017-01-26T08:38:01ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>Why in the /etc/prelude-lml directory, the permissions are forced to 700 and 600?</p> LibpreludeDB - Bug #867 (New): libpreludedb : missing -lpreludecpp when linkinghttp://www.prelude-siem.org/issues/8672017-01-11T08:24:33ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>With rpmlint, I got this :<br /><pre>
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 typeinfo for Prelude::PreludeError
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::PreludeError::what() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::isNull() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::~IDMEFValue()
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::operator idmef_value*() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::toString[abi:cxx11]() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEF::operator idmef_object*() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::IDMEFValue(idmef_value*)
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::PreludeError::PreludeError()
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 vtable for Prelude::PreludeError
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::getType() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFPath::operator idmef_path*() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEF::IDMEF(idmef_object*)
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFCriteria::operator idmef_criteria*() const
</pre></p>
<p>This is because, in bindings/c++/Makefile, the variable "libpreludedbcpp_la_LDFLAGS" is missing "-lpreludecpp"</p>
<p>Also, it seems that libprelude-config never provide -lpreludecpp</p> LibpreludeDB - Bug #866 (New): libpreludedb : manpages warninghttp://www.prelude-siem.org/issues/8662017-01-11T08:22:05ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>When running rpmlint, I got this :<br /><pre>
libpreludedb-devel.x86_64: W: manual-page-warning /usr/share/man/man1/libpreludedb-config.1.gz 23: a special character is not allowed in a name
</pre></p>
<p>Patch :<br /><pre>
--- ./docs/manpages/libpreludedb-config.1 2016-09-15 08:49:14.234000884 +0200
+++ ./docs/manpages/libpreludedb-config.1 2017-01-10 08:22:39.280448484 +0100
@@ -20,7 +20,7 @@
.B \-\-libs
options.
This option must be specified before any
-.B\-\-libs
+.B \-\-libs
or
.B \-\-cflags
options. This
</pre></p> PRELUDE SIEM - Bug #865 (New): make distcheck not working on 32bithttp://www.prelude-siem.org/issues/8652016-12-05T22:33:54ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>make distcheck is not working on 32 bits architecture because of timegm behavior.</p> PRELUDE SIEM - Bug #863 (New): FSF address in libprelude-errorhttp://www.prelude-siem.org/issues/8632016-11-30T23:14:57ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>Please update FSF address in libprelude-error</p> Libprelude - Bug #860 (Assigned): Fedora : ruby sitearchdir need to be vendorarchdirhttp://www.prelude-siem.org/issues/8602016-10-31T21:33:18ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>On Fedora, sitearchdir is not defined, so ruby "so" file go to /usr/local.</p>
<p>On Fedora it is vendorarchdir</p> LibpreludeDB - Bug #392 (Assigned): Potential security risc in preludedb-admin?http://www.prelude-siem.org/issues/3922011-01-15T15:37:50ZPaul Buetowprelude@mx.buetow.org
<p>Hi!</p>
<p>I wanted to ask a question regarding preludedb-admin.</p>
<p>I am using 0.9.14.1-2 (Debian GNU/Linux Lenny). There is no way not to<br />define the database password (e.g. mysql password) NOT in the command<br />line argument. The password shows up in plain text in the system<br />process list while using preludedb-admin.</p>
<p>It should be possible to "pipe" the arguments to preludedb-admin</p>
<p>The current way:</p>
<p>preludedb-admin delete alert "type=mysql name=prelude user=prelude<br />pass=prelude" --criteria "alert.create_time < $DATE"</p>
<p>"Better way":</p>
<p>some-script-generating-arguments | preludedb-admin</p>
<p>(Alternatively just pipe the "type=mysql name=prelude user=prelude" <br />part)</p>
<p>And / Or:</p>
<p>preludedb-admin --args filename</p>
<p>(Alternatively just read the "type=mysql name=prelude user=prelude" <br />part from file)</p>
<p>And / Or:</p>
<p>Read password from an environment variable:</p>
<p>#/bin/sh</p>
<p>export PRELUDE_PASS=prelude<br />exec preludedb-admin delete alert "type=mysql name=prelude<br />user=prelude" --criteria "alert.create_time < $DATE"</p>
<p>And / Or:</p>
<p>Read password from stdin if missing in the argument.</p>
<p>Hope you got my point <img src="/plugin_assets/redmine_wiki_extensions/images/smile.png" alt=":)"></p>
<p>Thanks a lot and best regards,</p> PRELUDE SIEM - Bug #349 (New): SANCP - problem on installhttp://www.prelude-siem.org/issues/3492009-05-18T09:27:51Zjulien aussibaljulien.aussibal@univ-pau.fr
<p>Hello everybody,</p>
<p>I'm trying to install sancp on my computer for looking my network.</p>
<p>First, the link of the tar.gz is dead on this page (<a class="external" href="https://dev.prelude-ids.com/wiki/prelude/InstallingAgentThirdpartySancp">https://dev.prelude-ids.com/wiki/prelude/InstallingAgentThirdpartySancp</a>) .</p>
<p>Secondly, I found a different version on this page : <a class="external" href="http://metre.net/files/">http://metre.net/files/</a><br />but the lastest version doesn't compile with prelude option.</p>
<p>Anybody have a stable version of sancp working with prelude ? Could you indicate how to configure it to log Alert in prelude-manager.</p>
<p>Thanks</p> PRELUDE SIEM - Bug #343 (New): OSSEC-HIDS 1.6.1 always sets assessment.impact.completion = succededhttp://www.prelude-siem.org/issues/3432009-01-25T20:06:12Z
<p>Example: the IDMEF alerts for both of these logs</p>
<pre>
[[WinEvtLog]]: Security: AUDIT_SUCCESS(673): Security: SYSTEM: NT AUTHORITY: SERVER: user@DOMAIN DOMAIN PC$ %{SOMERANDOMUIDHERE} 0x40810010 0x17 10.10.10.10 - {SOMEOTHERUID} -
[[WinEvtLog]]: Security: AUDIT_FAILURE(673): Security: SYSTEM: NT AUTHORITY: SERVER: - 0x2 - 10.10.10.10 0x20 - -
</pre>
<p>have assessment.impact.completion = succeeded</p>
<p>See also: <a class="external" href="http://marc.info/?t=123274084100006&r=1&w=2">http://marc.info/?t=123274084100006&r=1&w=2</a></p> LibpreludeDB - Bug #337 (New): Fake result number of deleted records in preludedb-adminhttp://www.prelude-siem.org/issues/3372008-12-08T17:16:54Z
<p>The output of preludedb-admin was:</p>
<p>delete event failed: Lost connection to [[MySQL]] server during query.</p>
<p>Error at transaction 448000. Use --offset 874000 to resume operation.</p>
<p>2152124949 'delete' events processed in 2783.401760 seconds (0.000001 seconds/events - 773199.535880 delete/sec average).</p>
<p>2152124949 events processed in 2783.401760 seconds (0.000001 seconds/events - 773199.535880 events/sec average).</p>
<p>2152124949 is the fake as '--offset 874000' says where it stopped.</p> Prelude-LML - Bug #215 (New): ntsyslog.rules does not detect domain login eventshttp://www.prelude-siem.org/issues/2152007-04-03T17:44:11Z
<p>The ruleset appears to detect only host-based login attempts rather than login attempts against a domain.</p>
<p>event id 675: (bad password)</p>
<p>security[failure] 675 NT AUTHORITY\SYSTEM Pre-authentication failed: User Name:mike User ID: %{x-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxx} Service Name:krbtgt/HQ Pre-Authentication Type:0x2 Failure Code:0x18 Client<br />Address:10.120.120.152</p>
<p>more info: <a class="external" href="http://www.ultimatewindowssecurity.com/events/com298.html">http://www.ultimatewindowssecurity.com/events/com298.html</a></p> Prelude-LML - Bug #214 (New): Invalid classification reference in several LML rulesetshttp://www.prelude-siem.org/issues/2142007-04-03T17:37:44ZYoann VANDOORSELAERE
<p>Some LML rulesets are missing an "url" field for the Classification Reference. IDMEF specify that the "url" member of a Reference has to be specified.</p>
Example of such rulesets are:
<ul>
<li>cisco-vpn.rules</li>
<li>cisco-css.rules</li>
</ul> Prelude-LML - Bug #213 (New): LML rulesets should be updated to use IDMEF Actionhttp://www.prelude-siem.org/issues/2132007-04-03T17:31:44ZYoann VANDOORSELAERE
<p>Current rulesets (except modsecurity) does not make use of the IDMEF Action class.</p>
<pre>
4.2.6.2. The Action Class
The Action class is used to describe any actions taken by the
analyzer in response to the event.
category
The type of action taken. The permitted values are shown below.
The default value is "other". (See also Section 10.)
+------+-------------------+----------------------------------------+
| Rank | Keyword | Description |
+------+-------------------+----------------------------------------+
| 0 | block-installed | A block of some sort was installed to |
| | | prevent an attack from reaching its |
| | | destination. The block could be a |
| | | port block, address block, etc., or |
| | | disabling a user account. |
| | | |
| 1 | notification-sent | A notification message of some sort |
| | | was sent out-of-band (via pager, |
| | | e-mail, etc.). Does not include the |
| | | transmission of this alert. |
| | | |
| 2 | taken-offline | A system, computer, or user was taken |
| | | offline, as when the computer is shut |
| | | down or a user is logged off. |
| | | |
| 3 | other | Anything not in one of the above |
| | | categories. |
+------+-------------------+----------------------------------------+
The element itself may be empty, or may contain a textual
description of the action, if the analyzer is able to provide
additional details.
</pre>