PaulDotCom mailing list archives

New projects, OSSEC parser for Kismet Alerts and CSV to OSSEC rules file


From: dninja at gmail.com (Robin Wood)
Date: Thu, 25 Feb 2010 11:19:59 +0000

I've just released two new projects, an OSSEC rules file for Kismet
Newcore alerts and a tool to convert a CSV file into the rules XML
file.

http://www.digininja.org/projects/ossec_kismet_rules.php

http://www.digininja.org/projects/ossec_rule_converter.php

I'm not an OSSEC user so these might not be done in the best way
possible but they seemed to get the job done for what I needed so
thought others might benefit, if you have feedback or improvements
please let me know.

The converter is pretty much currently geared to my Kismet file but
anyone with a bit of programming skill should be able to update it to
handle any other set of rules they want to manage.

Robin

PS. These have actually been on my site for a while as I accidentally
put them live but forgot to announce them!


Current thread: