From OSSEC Wiki

Contents 1 How to enable Prelude Support? 1.1 Enable Prelude Support 1.2 Enable Prelude output in the configuration 1.3 Prelude extra options

How to enable Prelude Support?

Prelude is a Hybrid IDS that uses IDMEF to receive alert information from external devices.

If you are a Prelude user and wish to send your OSSEC alerts to Prelude, do the following:

Enable Prelude Support

• You must have the Prelude libraries installed on the OSSEC server.

Before you run the "./install.sh" script, execute the following:

$ cd ossec-hids-xx
$ cd src; make setprelude; cd ..
$ ./install.sh

Enable Prelude output in the configuration

Just add the following entry to your ossec.conf:

  <prelude_output>yes</prelude_output>

Prelude extra options

You can define your own profile and set the log level from which you can send alerts to prelude with those parameters:

  <prelude_profile>MyOssecProfile</prelude_profile>
  <prelude_log_level>6</prelude_log_level>