forked from Prelude-SIEM/prelude-correlator
-
Notifications
You must be signed in to change notification settings - Fork 0
/
NEWS
550 lines (297 loc) · 14.6 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
* 2016-09-14, prelude-correlator-3.1.0:
* 2016-09-01, prelude-correlator-3.1.0rc3:
* 2016-08-19, prelude-correlator-3.1.0rc2:
No new changes.
* 2016-08-05, prelude-correlator-3.1.0rc1:
Author: Antoine Luong
- Prevent potential import errors when loading contexts
- Rename analyzer model to 'Prelude Correlator'
- Minor fixes in exception handling
Author: Thomas Andrejak
- Make the context able to access plugins
- Disable flatten when getting alert.source(*) in BruteForce
- Missing import in prelude-correlator plugin manager
Author: Abdel Elmili
- Add --profile option to prelude-correlator
The goal of adding this option is to allow operators to run more than
one correlator on the same host. Each correlator will use a different
profile.
Author: Sélim Menouar
- Clearly separate File and IDMEFClient inputs
* 2016-04-22, prelude-correlator-3.0.0:
No new changes.
* 2016-04-15, prelude-correlator-3.0.0rc4:
Author: François Poirotte
- Re-enable SpamHaus plugin & add warning
* 2016-04-08, prelude-correlator-1.3.0rc3:
Author: Thomas Andrejak
- Add CIArmy blacklist like DShield or Spamhaus
- Fix download() with text/plain files
* 2016-04-01, prelude-correlator-1.3.0rc2:
Author: Yoann Vandoorselaere
- Fix incorrect aggregation in some corner case
Author: François Poirotte
- Single alert for hosts with multiple IPs
* 2016-03-25, prelude-correlator-1.3.0rc1:
Author: Yoann Vandoorselaere
- Pickle compatibility for IDMEF object
Author: Louis-David Gabet
- Comment python_rules section by default
* 2016-03-18, prelude-correlator-1.3.0beta2:
Author: Louis-David Gabet
- Fix 'python_rules' section error
Author: Thomas Andrejak
- Fix wrong access to entrypoint name
* 2016-03-01, prelude-correlator-1.3.0beta1:
Author: Song Tran
- Add additional SELinux policies
Author: Thomas Andrejak
- Load plugins from entrypoints and directories
- The README in conf.d was not the right file
- Change prelude-ids.com to prelude-siem.com
* 2016-01-11, prelude-correlator-1.3.0alpha1:
Author: Louis-David Gabet
- Add include section to configuration file
to allow independent configuration files for plugins
Author: Antoine Luong
- Correct download address parameter in conf
Author: Song Tran
- Add SELinux policy for prelude-correlator
* 2015-07-31, prelude-correlator-1.2.6:
No new changes.
* 2015-07-27, prelude-correlator-1.2.6rc5:
Author: Antoine Luong
- Disable SpamhausDrop rule by default
- Add the -D shortcut for debug mode, to be consistent with other Prelude modules
- Update dshield.dat and spamhaus_drop.dat
* 2014-10-27, prelude-correlator-1.2.6rc4:
Author: Yoann Vandoorselaere
- Reset IDMEF CreateTime when sending an alert
- Fix possible exception in case of download failure
- Minor fixes
* 2014-09-23, prelude-correlator-1.2.6rc2:
Author: Yoann Vandoorselaere
- Rework exception flow
- Verify plugin enable/disable attribute before entrypoint loading
Allow the user to disable a plugin before the entrypoint is called
(useful if the plugin entrypoint triggers, for example, an exception).
- Remove semi broken EGG support for now, improve require API for future use
- Namespace support
- Corrected permissions checking
- Remove uppercase from package name, as specified in PEP8
- Update for latest libprelude bindings API changes
High level bindings in libprelude are now the standard, and got renamed
from "PreludeEasy" to "prelude". Method names were also renamed.
- Python3 compatibility work
* 2014-09-16, prelude-correlator-1.2.6rc1:
Author: Yoann Vandoorselaere
- Fix problem with --root installation, and --prefix=/
- Syslog logging fallback to UDP localhost if no socket is found
- Various timer fixes
- Timers added multiple times on reset
- Timers with negative expiration time not initialized correctly
- Unnecessary traversal of the timer list on reset
- Introduce a new DownloadCache, used by Dshield and Spamhaus plugin
- Prevent traceback on profile error
* 2014-07-07, prelude-correlator-1.2.5:
- Improved exception handling
- Support IDMEF Alert merge, to avoid CorrelationAlert listing
the same source multiples times
- Allow pluginmanager API to be used with multiples entrypoints
A Prelude-Correlator plugin may now use the pluginmanager API with
their own entrypoint to load their own sub-plugins.
- Allow plugin to specify a list of conflicting plugins
Using this interface, a plugin can now provide a list of other plugins
that conflict with him, and that shouldn't be loaded.
Additionally, provide a way for the user to force loading of a plugin
that was disabled because of a conflict (using enable = force in the
configuration section for the plugin).
- Add autoload attribute to the generic Plugin class
This attribute controls whether PluginManager() will directly load a given
plugin or only references the plugin class for later loading. Default behavior
is to load the plugins.
- Various timer improvements
- Add an option to read IDMEF input from file,
within the given offset / limit
- Add a stats() function which can be used by a plugin
to provide statistics printing
- Implement GetAdditionalDataByMeaning() method
- Always retrieve the current time when no argument is supplied
- Add --disabledl option to setup.py sdist
Downloading Spamhaus database need real user-agent, using Mozilla 5
- Logging fixes, using Python logging API
- Add the ability to set debug log level
- Updated dshield.dat, spamhaus_drop.dat
- Removed rhel6 packaging
* 2013-09-20, prelude-correlator-1.0.2:
- setup.py : Fixed files downloading behind proxies
- RHEL : Added missing dependency to python-setuptools
- RHEL : Fixed #517 : Prelude Correlator not starting (SELinux)
- RHEL : Fixed #494 : Prelude Correlator not stopping
- Added some debug infos
* 2012-06-01, prelude-correlator-1.0.1:
- Fixed #494 : Prelude Correlator not stopping
- Changed Copyright
- Added packaging for rhel6
- Ability to specify an input IDMEF criteria
There is now a [general] configuration section in prelude-correlator.conf
allowing to specify a criteria option that use an IDMEF criteria parameter
as an argument.
Using this option, it is possible to specify an input filter for events
to be processed by the correlator.
Additionally, always use an IDMEFCriteria to check whether the input
event is an alert, in place of manually retrieving alert.create_time.
- Fixed some typo
- Implement Context time merging capability
Introduced time merging capability within Prelude-Correlator:
as of now, correlation contexts are associated with the time of the
triggering IDMEF event.
When searching for a matching context, an existing context will only be
returned in case the specified search time match the time windows of an
existing context.
This mean that when receiving a burst of events, the time carried with
events is directly taken into account : separate instances exists for
the same Context associated with events received at a different time.
Additionally, context can be merged if more than one context time windows
overlap.
* 2010-03-16, prelude-correlator-1.0.0:
- When Prelude-Correlator is started as a daemon, make sure we use
syslog for logging.
- Fix an exception when adding an alert with no source or target to the
generated Correlation alert, by Frédéric Yhuel
- Do not generate Brute Force CorrelationAlert for multiples successful
authentication.
- Workaround documentation installation problem.
* 2010-03-08, prelude-correlator-1.0.0rc4:
- Fix installation problem (#372).
* 2010-03-05, prelude-correlator-1.0.0rc3:
- Prelude-Correlator wasn't properly updating context (and thus, didn't
generate correlation events) since context identifiers were escaped
twice.
- Prevent exception when Prelude-Correlator attempt to restore contexts
from an earlier Prelude-Correlator version, and that the context
internal attributes have changed.
- A sample-plugin example has been included in the distribution.
* 2010-02-01, prelude-correlator-1.0.0rc2:
- Fix generated tarball name, so that the package might easily be
included in various distribution for testing.
* 2010-01-29, prelude-correlator-1.0.0rc1:
- [Firewall]: The plugin will now report CorrelationAlert for events /
sets of events that appear to have passed through a firewall known to
protect the target machine. If no firewall ever emit block concerning
a given host, then this host is considered un-protected, and there is
no point in reporting CorrelationAlert.
- [OpenSSHAuth]: The plugin has been modified so that it can now
generate a single CorrelationAlert for multiples authentication method
used in a given time slice.
- [Spamhaus]: The plugin has been modified so that it can now generate a
single CorrelationAlert for multiples events received from the same
source.
- [BruteForce]: Various improvement, do not limit the number of events
the plugin is able to report in a single CorrelationAlert.
- [Scan]: do not limit the number of events the plugin is able to report
in a single CorrelationAlert.
- Context initialization now take an optional 'overwrite' argument. This
argument, if set to False, mean that the Context() will be returned
un-modified if it already exist. If it doesn't, it will be created.
- New Context.update() method, which provide exactly the same
functionality as calling Context() with the 'update=True' argument.
This is useful since some plugin need to defer an update to another
place in the code.
- If the context creation/update function is called with an IDMEF message
parameter, then we automatically call addAlertReference on the context
CorrelationAlert using the provided message as the parameter.
- Make it possible to change context option on update
- Automatically set CorrelationAlert DetectTime : reported
CorrelationAlert DetectTime now match the time of the first event that
was detected.
- Make it possible for plugin to specify a function to be called on
Timer expiration.
- Disable BusinessHour correlation by default since it is very verbose
- Various bug fixes.
* 2009-11-03, prelude-correlator-0.9.0-beta8:
- Include spamhaus_drop.dat in the source distribution. Fix installation
issue (closes #364).
* 2009-11-02, prelude-correlator-0.9.0-beta7:
- Initial SpamhausDrop plugin implementation, by
Wes Young <[email protected]> (closes #363)
- Do not discard --root parameters if prefix is absolute.
- Python 2.4 backward compatibility fixes.
- Handle plugin loading error gracefully.
- Improve WormPlugin accuracy, and make it carry a reference to the
initial event. The plugin used to alert when seeing an alert to a
given target, and this same alert going back to the source. This can
happen in a number of case (example: Netbios alert triggered by Snort)
As of now, the plugin will wait for the events to be repeated against
at least 5 differents hosts.
- Dshield CorrelationAlert now handle multiples events. Previously, we
used to generate a single Dshield CorrelationAlert for each events
where the source address would match the Dshield database. The plugin
now generate CorrelationAlert for multiples events received from the
same source.
* 2009-07-09, prelude-correlator-0.9.0-beta6:
- Provide a default configuration file, and fixes the prelude-correlator
--config option.
- A rare exception could occur when IDMEF:Set() was called with
an empty list/tuple as the value argument.
- Normalize libprelude logging through our own log callback (only
enabled if libprelude >= 0.9.24 is installed).
- The DShield plugin didn't report any events since address loaded
from the DShield database weren't correctly normalized.
- Automatic download + reloading of the DShield database was fixed.
- DShield generated alerts now include additional details.
- Make it possible to specify your own DShield database file, and to
prevent automatic download. This is useful on system with no direct
internet access.
- Handle both standard installation, and EGG installation method (in EGG
mode, configuration and data files are self contained).
- Introduce a new plugin logging mechanism.
- Add some utility method to the Timer class.
- Make it possible for plugin to define a 'signal' method that will
get called when prelude-correlator handle a signal (can be used to
perform special handling before exit, statistics or debugging
purposes).
* 2009-06-18, prelude-correlator-0.9.0-beta5:
- A bug prevented prelude-correlator from starting in daemon mode when
using the '--pidfile' option. Fixes #355.
- Prevent prelude-correlator from abording if a plugin fail. Emit
a warning explaining why a given plugin couldn't load, and continue
processing.
- Implement a timeout for Dshield.org server connection. The default
is 10 seconds, and might be modified from the prelude-correlator.conf
configuration file. This prevent Dshield host list loading from
blocking forever, and fixes #353.
- Make it possible to disable plugin (fixes #354), by adding the following setting
in prelude-correlator.conf:
[PluginClassName]
disable = true
- Read plugin configuration from prelude-correlator.conf
- Use the Python logging facility.
- Correct copyright notice, add missing AUTHORS, COPYING, HACKING.README files.
* 2009-06-17, prelude-correlator-0.9.0-beta4:
- Initial Python Correlator version. Rationale for the switch available here:
http://lists.prelude-ids.org/pipermail/prelude-user/2009-April/005163.html
- Support DShield <http://www.dshield.org/> correlation!
* 2008-07-11, prelude-correlator-0.9.0-beta3:
- Add missing AUTHORS file.
- Allow setting 'nil' IDMEF value using IDMEF:set() (#297).
- Fix ctx:set() typo in the business-hour.lua rulese (#297).
* 2008-07-03, prelude-correlator-0.9.0-beta2:
- Fix issues with the business-hour ruleset, that tried updating a non
existing context. This rule does not need a context at all, rather a
simple IDMEF object is sufficiant.
- Always return a table when retrieving multiple path (even
with empty path). Fix #295.
- Correct multi-path detection (was not working with exactly two IDMEF
path).
- Fix invalid installation path under certain conditions, thanks
to Steve Grubb <[email protected]> for pointing that out.
* 2008-06-27, prelude-correlator-0.9.0-beta1b:
- Fix invalid installation path under certain conditions.
* 2008-06-27, prelude-correlator-0.9.0-beta1a:
- Always use $(DESTDIR) when installing files.
- Check for lua.pc as well as lua5.1.pc, since different distribution
seems to be using different default.
* 2008-06-27, prelude-correlator-0.9.0-beta1:
- First Prelude-Correlator release.