From mboxrd@z Thu Jan 1 00:00:00 1970 From: Klaus Heinrich Kiwi Subject: Re: [RFC] programmatic IDS routing Date: Fri, 21 Mar 2008 07:28:42 -0300 Message-ID: <1206095322.9069.40.camel@klausk.br.ibm.com> References: <200803191302.48434.sgrubb@redhat.com> <200803191944.03857.sgrubb@redhat.com> <47E2676D.9020409@hp.com> <200803200953.33566.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200803200953.33566.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: Linux Audit , Valdis.Kletnieks@vt.edu List-Id: linux-audit@redhat.com > > So the admin would create the rule he wants, create a unique key and tell > > the IDS what the key is and how it should react when it sees a record with > > that key. > > Yes. What I want to do is also say that if you create your unique key a > certain way, you get this additional benefit of realtime alerting or > correlation. if you choose not to, then its treated as any other event I agree with Steve's compromise with speed, but maybe there's no way out of using hashes or linked lists in the general case. What if a message is important not only for the IDS plugin but also to a fictional 'real-time compliance reporting' plugin - both wanting to use the key field to carry special things, and in the same event: type=USER_ACCT msg=... key=ids-file-high,sox-fault-med,actual_key The plug-ins would need to check if their specific identifier is present not only in the first 4 bytes, but after every comma. If it's desirable to support the general case, instead of putting everything in one single 'key' field, maybe having an index just like execve arguments: type=USER_ACCT msg=... key[0]=ids-file-high key[1]=sox-fault-med key[2]=actual_key Still need to iterate through all keys in the worst case, but the plugins could individually chose between having the rules hardcoded (for speed) or configurable. -Klaus -- Klaus Heinrich Kiwi Security Development - IBM Linux Technology Center