Creating filter using IDMEF Criteria¶
IDMEF Criteria are filters on IDMEF fields.
Several Prelude components use IDMEF Criteria in order to provide IDMEF filtering capability.
- Prelude-Manager comes with the idmef-criteria-filter plugin, that can be hooked and use IDMEF Criteria, defining specific actions to take for an incoming events (relaying it, storing it in a specific database, etc).
- The Prewikka interface allows the user to setup criteria in order to filter query results.
IDMEF Criteria syntax¶
<IDMEF Path> <operator> <value>
alert.analyzer(-1).name = 'MySensor'
Note that you can use boolean AND / OR:
alert.analyzer(-1).name = 'MySensor' && ('alert.assessment.impact.severity = 'high' || alert.assessment.impact.completion = 'succeeded')
Available IDMEF path¶
In order to know more about the IDMEF Path you can use, please have a look at the IDMEFPath documentation
= -> Case sensitive equal. =* -> Case insensitive equal. != -> Case sensitive not equal. !=* -> Case insensitive not equal. ~ -> Case sensitive Regexp. ~* -> Case insensitive regexp. !~ -> Case sensitive, not matched regexp. !~* -> Case insensitive, not matched regexp. < -> Lower than. <= -> Lower or equal than > -> Higher than. >= -> Higher or equal than. <> -> Case sensitive sub-string. <>* -> Case insensitive sub-string. !<> -> Case sensitive not sub-string. !<>* -> Case insensitive not sub-string.