Re: which IDS

[Krzysztof Zaraska <kzaraska () student uci agh edu pl>]

On Thu, 14 Nov 2002 08:44:49 -0200
Adriano Ribeiro <r00t () o2 net br> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> You could catch the Prelude, in: http://www.prelude-ids.org, it's
> compatible with snort rules, but, uses other engine for intrusion
> detection, You will go to like, some information more:
>
> 1 - Is a distributed.
> 2 - Is a network and host IDS
> 3 - Compatible with CIDF.

Being involved in Prelude development, I must correct last statement:
Prelude is _not_ compatible with CIDF. I think you wanted say IDMEF :-)
And it actually uses IDMEF for all the alert processing (more precisely,
we use internally a binary representation of IDMEF data model, which can
be of course exported to XML). 

-- 
// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// Prelude IDS: http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//              -- Stanislaw Lem