Steve Grubb from Redhat wrote the prelude plugin for auditd, the SELinux daemon which logs policies violations.

The plugin can currently detect and message: Apps that terminate abnormally (gcc stack overflow/glibc FORTIFY_SOURCE/plain old segfault), SE Linux AVCs, Logins, MAX failed login attempts reached, MAX concurrent sessions reached. This is all done in real-time and not based on a cron job. The audit daemon is capable of being run directly from init if you wanted to do it that way.

The package, installation instructions are available at: http://people.redhat.com/sgrubb/audit/.

If you run fedora core 8, you can try it easily by running:

To do testing on Fedora rawhide (which will become Fedora 9), you will need to put selinux in permissive mode, "setenforce 0".

More information available in Steve’s auditd+prelude HOWTO.

OSSEC HIDS is a host based intrusion detection system that performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, real-time alerting and active response.

It is now able to communicate and use all the features of the Prelude IDS framework. You can find more informations about this in the email that I sent on the mailing list here.

Please test and report bugs, so that the upcoming release will have a strong and rocking prelude support.

Prelude packages are now officially available for Fedora Extra (FC5, FC6, and upcoming FC7 - i386, x86_64, ppc architecture are supported). This long overdue addition allows to install the different parts of Prelude on RedHat systems.

Available package:
 libprelude
 libpreludedb
 prelude-lml
 prelude-manager
 prewikka

To install a package, use the "install" option with yum:
yum install [package-name]

Prelude has been imported in the OpenBSD ports tree. This long overdue addition allows to build the different parts of Prelude (libprelude, manager, etc.) from sources, and binary packages are also available, as the rest of the tree.

The port has the following layout:
 security/prelude/libprelude
 security/prelude/libpreludedb
 security/prelude/manager
 security/prelude/lml
 security/prelude/pflogger
 security/prelude/prewikka

Several flavors of libpreludedb are available, for PostgreSQL, MySQL and SQLite DBMS.

The OpenBSD package system documentation is available at: http://www.openbsd.org/faq/faq15.html

For about one week now, an important albeit unnoticed correlation effort have been going on. The outcome of this work (in progress, but already working and robust) is available in the Prelude SVN repository SEC module http://svn.prelude-ids.org/trunk/sec.

We are very much looking for people to contribute useful correlation rules at this stage.
More information in the mailing list post .

Prelude has been added to the NetBSD package system (pkgsrc). The NetBSD Packages Collection (pkgsrc) is a framework for building third-party software on NetBSD and other UNIX-like systems.

The new packages are:
 security/libprelude
 security/libpreludedb
 security/prelude-manager
 security/prelude-lml
 security/py-prewikka
 net/snort-prelude

Information on the NetBSD package system is available at:

 http://www.netbsd.org/Documentation...
 http://www.pkgsrc.org/

The Honeynet Project has just released mwcollect 3.0.1 featuring Prelude IDS support.

mwcollect is a UNIX daemon dedicated to collecting in-the-wild malware spreading using known exploits.

 mwcollect
 Download

Robin Gruyters has contributed a patch for Shadow to report events to the Prelude-IDS system.

Shadow is the result of a project that was originally called the Cooperative Intrusion Detection Evaluation and Response (CIDER) project. It was an effort of NSWC Dahlgren, NFR, NSA, the SANS community and other interested parties to locate, document, and improve security software.

We are looking for user feedback with the current instance of the patch, which is available at https://trac.prelude-ids.org/ticket/98. Please give your feedback on the opened ticket.

Frank van Vliet has contributed a patch for Sancp to report events to the Prelude-IDS system.

Sancp is a network security tool designed to collect statistical information regarding network traffic, as well as collect the traffic itself for the purpose of: auditing, historical analysis, and network activity discovery. Rules can be used to distinguish normal from abnormal traffic and support tagging connections with: rule id, node id, and status id.

We are looking for user feedback with the current instance of the patch, which is available at https://trac.prelude-ids.org/ticket/91. Please give your feedback on the opened ticket.

Prelude support has officially been added to the Snort 2.4 branch.

By using —enable-prelude during configuration you will be able to add the ability to report alerts to Prelude.

In order to access the Prelude repository as an anonymous user, you should now use http://svn.prelude-ids.org instead of https://svn.prelude-ids.org.

This change has been made because of problem in the way SVN request credentials.

News and developments for the month of June for Prelude.

With the close of June development is closing in on the release of 0-9. Many bugs have been cleaned up from Trunk as well as many functionality improvements have been made.

NOTE: the numbers referenced by ’#’ are from tickets in Prelude Trac, for additional reference.)