* 2018-09-28, prelude-correlator-5.0.1: Author: Antoine Luong - Fix context constructor signature * 2018-09-07, prelude-correlator-5.0.0: No new changes. * 2018-08-17, prelude-correlator-5.0.0rc1: Author: Antoine Luong - Allow local meta-correlation - Provide the rule ID in correlation alerts - Stop using ez_setup.py Author: Yoann Vandoorselaere - Environment should be globally available - Implement a plugin state saving method Author: Thomas Andrejak - Fix python 3 compatibility * 2018-05-04, prelude-correlator-5.0.0beta2: * 2018-04-13, prelude-correlator-5.0.0beta1: No new changes. * 2018-02-09, prelude-correlator-4.2.0rc1: Author: Antoine Luong - Fix context destruction while iterating - Add flake8 rules and make the code PEP-8 valid * 2017-07-21, prelude-correlator-4.1.0: Author: Thomas Andrejak - Add support for key:value out of a config section Author: Antoine Luong - Avoid displaying a traceback * 2017-07-13, prelude-correlator-4.1.0rc2: Author: Antoine Luong - Allow passing prelude-specific options in configuration * 2017-06-30, prelude-correlator-4.1.0rc1: * 2017-06-23, prelude-correlator-4.1.0beta2: * 2017-06-16, prelude-correlator-4.1.0beta1: No new changes. * 2017-02-16, prelude-correlator-4.0.0: No new changes. * 2017-02-12, prelude-correlator-4.0.0rc3: Author: Thomas Andrejak - Fix Python 3 compatibility Author: Camille Gardet - Fix CIArmy config keyword * 2017-02-03, prelude-correlator-4.0.0rc2: Author: Song Tran - Add INSTALL file * 2017-01-27, prelude-correlator-4.0.0rc1: * 2017-01-12, prelude-correlator-4.0.0beta2: * 2016-12-23, prelude-correlator-4.0.0beta1: No new changes. * 2016-09-14, prelude-correlator-3.1.0: * 2016-09-01, prelude-correlator-3.1.0rc3: * 2016-08-19, prelude-correlator-3.1.0rc2: No new changes. * 2016-08-05, prelude-correlator-3.1.0rc1: Author: Antoine Luong - Prevent potential import errors when loading contexts - Rename analyzer model to 'Prelude Correlator' - Minor fixes in exception handling Author: Thomas Andrejak - Make the context able to access plugins - Disable flatten when getting alert.source(*) in BruteForce - Missing import in prelude-correlator plugin manager Author: Abdel Elmili - Add --profile option to prelude-correlator The goal of adding this option is to allow operators to run more than one correlator on the same host. Each correlator will use a different profile. Author: Sélim Menouar - Clearly separate File and IDMEFClient inputs * 2016-04-22, prelude-correlator-3.0.0: No new changes. * 2016-04-15, prelude-correlator-3.0.0rc4: Author: François Poirotte - Re-enable SpamHaus plugin & add warning * 2016-04-08, prelude-correlator-1.3.0rc3: Author: Thomas Andrejak - Add CIArmy blacklist like DShield or Spamhaus - Fix download() with text/plain files * 2016-04-01, prelude-correlator-1.3.0rc2: Author: Yoann Vandoorselaere - Fix incorrect aggregation in some corner case Author: François Poirotte - Single alert for hosts with multiple IPs * 2016-03-25, prelude-correlator-1.3.0rc1: Author: Yoann Vandoorselaere - Pickle compatibility for IDMEF object Author: Louis-David Gabet - Comment python_rules section by default * 2016-03-18, prelude-correlator-1.3.0beta2: Author: Louis-David Gabet - Fix 'python_rules' section error Author: Thomas Andrejak - Fix wrong access to entrypoint name * 2016-03-01, prelude-correlator-1.3.0beta1: Author: Song Tran - Add additional SELinux policies Author: Thomas Andrejak - Load plugins from entrypoints and directories - The README in conf.d was not the right file - Change prelude-ids.com to prelude-siem.com * 2016-01-11, prelude-correlator-1.3.0alpha1: Author: Louis-David Gabet - Add include section to configuration file to allow independent configuration files for plugins Author: Antoine Luong - Correct download address parameter in conf Author: Song Tran - Add SELinux policy for prelude-correlator * 2015-07-31, prelude-correlator-1.2.6: No new changes. * 2015-07-27, prelude-correlator-1.2.6rc5: Author: Antoine Luong - Disable SpamhausDrop rule by default - Add the -D shortcut for debug mode, to be consistent with other Prelude modules - Update dshield.dat and spamhaus_drop.dat * 2014-10-27, prelude-correlator-1.2.6rc4: Author: Yoann Vandoorselaere - Reset IDMEF CreateTime when sending an alert - Fix possible exception in case of download failure - Minor fixes * 2014-09-23, prelude-correlator-1.2.6rc2: Author: Yoann Vandoorselaere - Rework exception flow - Verify plugin enable/disable attribute before entrypoint loading Allow the user to disable a plugin before the entrypoint is called (useful if the plugin entrypoint triggers, for example, an exception). - Remove semi broken EGG support for now, improve require API for future use - Namespace support - Corrected permissions checking - Remove uppercase from package name, as specified in PEP8 - Update for latest libprelude bindings API changes High level bindings in libprelude are now the standard, and got renamed from "PreludeEasy" to "prelude". Method names were also renamed. - Python3 compatibility work * 2014-09-16, prelude-correlator-1.2.6rc1: Author: Yoann Vandoorselaere - Fix problem with --root installation, and --prefix=/ - Syslog logging fallback to UDP localhost if no socket is found - Various timer fixes - Timers added multiple times on reset - Timers with negative expiration time not initialized correctly - Unnecessary traversal of the timer list on reset - Introduce a new DownloadCache, used by Dshield and Spamhaus plugin - Prevent traceback on profile error * 2014-07-07, prelude-correlator-1.2.5: - Improved exception handling - Support IDMEF Alert merge, to avoid CorrelationAlert listing the same source multiples times - Allow pluginmanager API to be used with multiples entrypoints A Prelude-Correlator plugin may now use the pluginmanager API with their own entrypoint to load their own sub-plugins. - Allow plugin to specify a list of conflicting plugins Using this interface, a plugin can now provide a list of other plugins that conflict with him, and that shouldn't be loaded. Additionally, provide a way for the user to force loading of a plugin that was disabled because of a conflict (using enable = force in the configuration section for the plugin). - Add autoload attribute to the generic Plugin class This attribute controls whether PluginManager() will directly load a given plugin or only references the plugin class for later loading. Default behavior is to load the plugins. - Various timer improvements - Add an option to read IDMEF input from file, within the given offset / limit - Add a stats() function which can be used by a plugin to provide statistics printing - Implement GetAdditionalDataByMeaning() method - Always retrieve the current time when no argument is supplied - Add --disabledl option to setup.py sdist Downloading Spamhaus database need real user-agent, using Mozilla 5 - Logging fixes, using Python logging API - Add the ability to set debug log level - Updated dshield.dat, spamhaus_drop.dat - Removed rhel6 packaging * 2013-09-20, prelude-correlator-1.0.2: - setup.py : Fixed files downloading behind proxies - RHEL : Added missing dependency to python-setuptools - RHEL : Fixed #517 : Prelude Correlator not starting (SELinux) - RHEL : Fixed #494 : Prelude Correlator not stopping - Added some debug infos * 2012-06-01, prelude-correlator-1.0.1: - Fixed #494 : Prelude Correlator not stopping - Changed Copyright - Added packaging for rhel6 - Ability to specify an input IDMEF criteria There is now a [general] configuration section in prelude-correlator.conf allowing to specify a criteria option that use an IDMEF criteria parameter as an argument. Using this option, it is possible to specify an input filter for events to be processed by the correlator. Additionally, always use an IDMEFCriteria to check whether the input event is an alert, in place of manually retrieving alert.create_time. - Fixed some typo - Implement Context time merging capability Introduced time merging capability within Prelude-Correlator: as of now, correlation contexts are associated with the time of the triggering IDMEF event. When searching for a matching context, an existing context will only be returned in case the specified search time match the time windows of an existing context. This mean that when receiving a burst of events, the time carried with events is directly taken into account : separate instances exists for the same Context associated with events received at a different time. Additionally, context can be merged if more than one context time windows overlap. * 2010-03-16, prelude-correlator-1.0.0: - When Prelude-Correlator is started as a daemon, make sure we use syslog for logging. - Fix an exception when adding an alert with no source or target to the generated Correlation alert, by Frédéric Yhuel <fyhuel@prelude-technologies.com> - Do not generate Brute Force CorrelationAlert for multiples successful authentication. - Workaround documentation installation problem. * 2010-03-08, prelude-correlator-1.0.0rc4: - Fix installation problem (#372). * 2010-03-05, prelude-correlator-1.0.0rc3: - Prelude-Correlator wasn't properly updating context (and thus, didn't generate correlation events) since context identifiers were escaped twice. - Prevent exception when Prelude-Correlator attempt to restore contexts from an earlier Prelude-Correlator version, and that the context internal attributes have changed. - A sample-plugin example has been included in the distribution. * 2010-02-01, prelude-correlator-1.0.0rc2: - Fix generated tarball name, so that the package might easily be included in various distribution for testing. * 2010-01-29, prelude-correlator-1.0.0rc1: - [Firewall]: The plugin will now report CorrelationAlert for events / sets of events that appear to have passed through a firewall known to protect the target machine. If no firewall ever emit block concerning a given host, then this host is considered un-protected, and there is no point in reporting CorrelationAlert. - [OpenSSHAuth]: The plugin has been modified so that it can now generate a single CorrelationAlert for multiples authentication method used in a given time slice. - [Spamhaus]: The plugin has been modified so that it can now generate a single CorrelationAlert for multiples events received from the same source. - [BruteForce]: Various improvement, do not limit the number of events the plugin is able to report in a single CorrelationAlert. - [Scan]: do not limit the number of events the plugin is able to report in a single CorrelationAlert. - Context initialization now take an optional 'overwrite' argument. This argument, if set to False, mean that the Context() will be returned un-modified if it already exist. If it doesn't, it will be created. - New Context.update() method, which provide exactly the same functionality as calling Context() with the 'update=True' argument. This is useful since some plugin need to defer an update to another place in the code. - If the context creation/update function is called with an IDMEF message parameter, then we automatically call addAlertReference on the context CorrelationAlert using the provided message as the parameter. - Make it possible to change context option on update - Automatically set CorrelationAlert DetectTime : reported CorrelationAlert DetectTime now match the time of the first event that was detected. - Make it possible for plugin to specify a function to be called on Timer expiration. - Disable BusinessHour correlation by default since it is very verbose - Various bug fixes. * 2009-11-03, prelude-correlator-0.9.0-beta8: - Include spamhaus_drop.dat in the source distribution. Fix installation issue (closes #364). * 2009-11-02, prelude-correlator-0.9.0-beta7: - Initial SpamhausDrop plugin implementation, by Wes Young <wes@barely3am.com> (closes #363) - Do not discard --root parameters if prefix is absolute. - Python 2.4 backward compatibility fixes. - Handle plugin loading error gracefully. - Improve WormPlugin accuracy, and make it carry a reference to the initial event. The plugin used to alert when seeing an alert to a given target, and this same alert going back to the source. This can happen in a number of case (example: Netbios alert triggered by Snort) As of now, the plugin will wait for the events to be repeated against at least 5 differents hosts. - Dshield CorrelationAlert now handle multiples events. Previously, we used to generate a single Dshield CorrelationAlert for each events where the source address would match the Dshield database. The plugin now generate CorrelationAlert for multiples events received from the same source. * 2009-07-09, prelude-correlator-0.9.0-beta6: - Provide a default configuration file, and fixes the prelude-correlator --config option. - A rare exception could occur when IDMEF:Set() was called with an empty list/tuple as the value argument. - Normalize libprelude logging through our own log callback (only enabled if libprelude >= 0.9.24 is installed). - The DShield plugin didn't report any events since address loaded from the DShield database weren't correctly normalized. - Automatic download + reloading of the DShield database was fixed. - DShield generated alerts now include additional details. - Make it possible to specify your own DShield database file, and to prevent automatic download. This is useful on system with no direct internet access. - Handle both standard installation, and EGG installation method (in EGG mode, configuration and data files are self contained). - Introduce a new plugin logging mechanism. - Add some utility method to the Timer class. - Make it possible for plugin to define a 'signal' method that will get called when prelude-correlator handle a signal (can be used to perform special handling before exit, statistics or debugging purposes). * 2009-06-18, prelude-correlator-0.9.0-beta5: - A bug prevented prelude-correlator from starting in daemon mode when using the '--pidfile' option. Fixes #355. - Prevent prelude-correlator from abording if a plugin fail. Emit a warning explaining why a given plugin couldn't load, and continue processing. - Implement a timeout for Dshield.org server connection. The default is 10 seconds, and might be modified from the prelude-correlator.conf configuration file. This prevent Dshield host list loading from blocking forever, and fixes #353. - Make it possible to disable plugin (fixes #354), by adding the following setting in prelude-correlator.conf: [PluginClassName] disable = true - Read plugin configuration from prelude-correlator.conf - Use the Python logging facility. - Correct copyright notice, add missing AUTHORS, COPYING, HACKING.README files. * 2009-06-17, prelude-correlator-0.9.0-beta4: - Initial Python Correlator version. Rationale for the switch available here: http://lists.prelude-ids.org/pipermail/prelude-user/2009-April/005163.html - Support DShield <http://www.dshield.org/> correlation! * 2008-07-11, prelude-correlator-0.9.0-beta3: - Add missing AUTHORS file. - Allow setting 'nil' IDMEF value using IDMEF:set() (#297). - Fix ctx:set() typo in the business-hour.lua rulese (#297). * 2008-07-03, prelude-correlator-0.9.0-beta2: - Fix issues with the business-hour ruleset, that tried updating a non existing context. This rule does not need a context at all, rather a simple IDMEF object is sufficiant. - Always return a table when retrieving multiple path (even with empty path). Fix #295. - Correct multi-path detection (was not working with exactly two IDMEF path). - Fix invalid installation path under certain conditions, thanks to Steve Grubb <sgrubb@redhat.com> for pointing that out. * 2008-06-27, prelude-correlator-0.9.0-beta1b: - Fix invalid installation path under certain conditions. * 2008-06-27, prelude-correlator-0.9.0-beta1a: - Always use $(DESTDIR) when installing files. - Check for lua.pc as well as lua5.1.pc, since different distribution seems to be using different default. * 2008-06-27, prelude-correlator-0.9.0-beta1: - First Prelude-Correlator release.