Subject: IDMEF Implementations besides Snort?

From: "Andrew Hintz (Drew)" <[email-masked]>
Date: Fri, 14 Jun 2002 19:51:56 +0200 (CEST)

Does anyone know of any IDMEF output plugins/converters for existing
IDSs or loggers, such as RealSecure, NFR, syslog, MS event log, etc?
The only one that I'm aware of is the Silicon Defense IDMEF output
plugin for Snort.

Thanks in advance,
-- 
^Drew

http://guh.nu

--Begin PGP Fingerprint--
3C6C F712 0A52 BD33 C518  5798 9014 CA99 2DA0 5E78
--End PGP Fingerprint--

---

From: "Laura S. Tinnel" <[email-masked]>
Date: Fri, 14 Jun 2002 18:41:22 -0400

Drew,

We have existing ones for Tripwire (Windows version), ZoneAlarm Pro, and 
the IPTables firewall (alerts on policy violations as defined in the rules 
file.) We have one partially working for the freeware Tripwire for Linux.

-Laura

---

From: Oudot Laurent <[email-masked]>
Date: Sat, 15 Jun 2002 00:36:12 +0200

Hi,

You should reach http://www.prelude-ids.org which is the site of a GNU
IDS project.
This IDS is hybrid (host & network based) and can be distributed easily
all around a big network.
Prelude is very fast and it's difficult to evade from it (whereas many
others IDS are easy to bypass...).
The output is fully IDMEF v6 compliant and is stocked in databases.
You can read thoses databases by using a web frontend that uses IDMEF
tags to show the alerts.

bye,

laurent oudot