idmef-message-read

idmef-message-read — Reading a message from a prelude_msg_t buffer

Synopsis




int         idmef_additional_data_read      (idmef_additional_data_t *additional_data,
                                             prelude_msg_t *msg);
int         idmef_reference_read            (idmef_reference_t *reference,
                                             prelude_msg_t *msg);
int         idmef_classification_read       (idmef_classification_t *classification,
                                             prelude_msg_t *msg);
int         idmef_user_id_read              (idmef_user_id_t *user_id,
                                             prelude_msg_t *msg);
int         idmef_user_read                 (idmef_user_t *user,
                                             prelude_msg_t *msg);
int         idmef_address_read              (idmef_address_t *address,
                                             prelude_msg_t *msg);
int         idmef_process_read              (idmef_process_t *process,
                                             prelude_msg_t *msg);
int         idmef_web_service_read          (idmef_web_service_t *web_service,
                                             prelude_msg_t *msg);
int         idmef_snmp_service_read         (idmef_snmp_service_t *snmp_service,
                                             prelude_msg_t *msg);
int         idmef_service_read              (idmef_service_t *service,
                                             prelude_msg_t *msg);
int         idmef_node_read                 (idmef_node_t *node,
                                             prelude_msg_t *msg);
int         idmef_source_read               (idmef_source_t *source,
                                             prelude_msg_t *msg);
int         idmef_file_access_read          (idmef_file_access_t *file_access,
                                             prelude_msg_t *msg);
int         idmef_inode_read                (idmef_inode_t *inode,
                                             prelude_msg_t *msg);
int         idmef_checksum_read             (idmef_checksum_t *checksum,
                                             prelude_msg_t *msg);
int         idmef_file_read                 (idmef_file_t *file,
                                             prelude_msg_t *msg);
int         idmef_linkage_read              (idmef_linkage_t *linkage,
                                             prelude_msg_t *msg);
int         idmef_target_read               (idmef_target_t *target,
                                             prelude_msg_t *msg);
int         idmef_analyzer_read             (idmef_analyzer_t *analyzer,
                                             prelude_msg_t *msg);
int         idmef_alertident_read           (idmef_alertident_t *alertident,
                                             prelude_msg_t *msg);
int         idmef_impact_read               (idmef_impact_t *impact,
                                             prelude_msg_t *msg);
int         idmef_action_read               (idmef_action_t *action,
                                             prelude_msg_t *msg);
int         idmef_confidence_read           (idmef_confidence_t *confidence,
                                             prelude_msg_t *msg);
int         idmef_assessment_read           (idmef_assessment_t *assessment,
                                             prelude_msg_t *msg);
int         idmef_tool_alert_read           (idmef_tool_alert_t *tool_alert,
                                             prelude_msg_t *msg);
int         idmef_correlation_alert_read    (idmef_correlation_alert_t *correlation_alert,
                                             prelude_msg_t *msg);
int         idmef_overflow_alert_read       (idmef_overflow_alert_t *overflow_alert,
                                             prelude_msg_t *msg);
int         idmef_alert_read                (idmef_alert_t *alert,
                                             prelude_msg_t *msg);
int         idmef_heartbeat_read            (idmef_heartbeat_t *heartbeat,
                                             prelude_msg_t *msg);
int         idmef_message_read              (idmef_message_t *message,
                                             prelude_msg_t *msg);

Description

Once you read a prelude_msg_t object, you need to decode this message. In case this is an IDMEF style message, the following API allow to read the relevant IDMEF fields from the prelude_msg_t object, and create the IDMEF object from it's content.

The function you're most probably looking to use is idmef_message_read(), and here is an example on how to use it:

int ret;
prelude_msg_t *pmsg;
idmef_message_t *message;

pmsg = whatever_method_to_get_a_prelude_msg();

ret = idmef_message_new(&message);
if ( ret < 0 )
        return ret;

ret = idmef_message_read(message, pmsg);

This will decode the full IDMEF message stored within pmsg into the idmef_message_t IDMEF object and it's childrens.

Details

idmef_additional_data_read ()

int         idmef_additional_data_read      (idmef_additional_data_t *additional_data,
                                             prelude_msg_t *msg);

Read an idmef_additional_data from the msg message, and store it into additional_data.

additional_data : Pointer to a idmef_additional_data_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_reference_read ()

int         idmef_reference_read            (idmef_reference_t *reference,
                                             prelude_msg_t *msg);

Read an idmef_reference from the msg message, and store it into reference.

reference : Pointer to a idmef_reference_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_classification_read ()

int         idmef_classification_read       (idmef_classification_t *classification,
                                             prelude_msg_t *msg);

Read an idmef_classification from the msg message, and store it into classification.

classification : Pointer to a idmef_classification_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_user_id_read ()

int         idmef_user_id_read              (idmef_user_id_t *user_id,
                                             prelude_msg_t *msg);

Read an idmef_user_id from the msg message, and store it into user_id.

user_id : Pointer to a idmef_user_id_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_user_read ()

int         idmef_user_read                 (idmef_user_t *user,
                                             prelude_msg_t *msg);

Read an idmef_user from the msg message, and store it into user.

user : Pointer to a idmef_user_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_address_read ()

int         idmef_address_read              (idmef_address_t *address,
                                             prelude_msg_t *msg);

Read an idmef_address from the msg message, and store it into address.

address : Pointer to a idmef_address_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_process_read ()

int         idmef_process_read              (idmef_process_t *process,
                                             prelude_msg_t *msg);

Read an idmef_process from the msg message, and store it into process.

process : Pointer to a idmef_process_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_web_service_read ()

int         idmef_web_service_read          (idmef_web_service_t *web_service,
                                             prelude_msg_t *msg);

Read an idmef_web_service from the msg message, and store it into web_service.

web_service : Pointer to a idmef_web_service_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_snmp_service_read ()

int         idmef_snmp_service_read         (idmef_snmp_service_t *snmp_service,
                                             prelude_msg_t *msg);

Read an idmef_snmp_service from the msg message, and store it into snmp_service.

snmp_service : Pointer to a idmef_snmp_service_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_service_read ()

int         idmef_service_read              (idmef_service_t *service,
                                             prelude_msg_t *msg);

Read an idmef_service from the msg message, and store it into service.

service : Pointer to a idmef_service_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_node_read ()

int         idmef_node_read                 (idmef_node_t *node,
                                             prelude_msg_t *msg);

Read an idmef_node from the msg message, and store it into node.

node : Pointer to a idmef_node_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_source_read ()

int         idmef_source_read               (idmef_source_t *source,
                                             prelude_msg_t *msg);

Read an idmef_source from the msg message, and store it into source.

source : Pointer to a idmef_source_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_file_access_read ()

int         idmef_file_access_read          (idmef_file_access_t *file_access,
                                             prelude_msg_t *msg);

Read an idmef_file_access from the msg message, and store it into file_access.

file_access : Pointer to a idmef_file_access_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_inode_read ()

int         idmef_inode_read                (idmef_inode_t *inode,
                                             prelude_msg_t *msg);

Read an idmef_inode from the msg message, and store it into inode.

inode : Pointer to a idmef_inode_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_checksum_read ()

int         idmef_checksum_read             (idmef_checksum_t *checksum,
                                             prelude_msg_t *msg);

Read an idmef_checksum from the msg message, and store it into checksum.

checksum : Pointer to a idmef_checksum_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_file_read ()

int         idmef_file_read                 (idmef_file_t *file,
                                             prelude_msg_t *msg);

Read an idmef_file from the msg message, and store it into file.

file : Pointer to a idmef_file_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_linkage_read ()

int         idmef_linkage_read              (idmef_linkage_t *linkage,
                                             prelude_msg_t *msg);

Read an idmef_linkage from the msg message, and store it into linkage.

linkage : Pointer to a idmef_linkage_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_target_read ()

int         idmef_target_read               (idmef_target_t *target,
                                             prelude_msg_t *msg);

Read an idmef_target from the msg message, and store it into target.

target : Pointer to a idmef_target_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_analyzer_read ()

int         idmef_analyzer_read             (idmef_analyzer_t *analyzer,
                                             prelude_msg_t *msg);

Read an idmef_analyzer from the msg message, and store it into analyzer.

analyzer : Pointer to a idmef_analyzer_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_alertident_read ()

int         idmef_alertident_read           (idmef_alertident_t *alertident,
                                             prelude_msg_t *msg);

Read an idmef_alertident from the msg message, and store it into alertident.

alertident : Pointer to a idmef_alertident_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_impact_read ()

int         idmef_impact_read               (idmef_impact_t *impact,
                                             prelude_msg_t *msg);

Read an idmef_impact from the msg message, and store it into impact.

impact : Pointer to a idmef_impact_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_action_read ()

int         idmef_action_read               (idmef_action_t *action,
                                             prelude_msg_t *msg);

Read an idmef_action from the msg message, and store it into action.

action : Pointer to a idmef_action_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_confidence_read ()

int         idmef_confidence_read           (idmef_confidence_t *confidence,
                                             prelude_msg_t *msg);

Read an idmef_confidence from the msg message, and store it into confidence.

confidence : Pointer to a idmef_confidence_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_assessment_read ()

int         idmef_assessment_read           (idmef_assessment_t *assessment,
                                             prelude_msg_t *msg);

Read an idmef_assessment from the msg message, and store it into assessment.

assessment : Pointer to a idmef_assessment_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_tool_alert_read ()

int         idmef_tool_alert_read           (idmef_tool_alert_t *tool_alert,
                                             prelude_msg_t *msg);

Read an idmef_tool_alert from the msg message, and store it into tool_alert.

tool_alert : Pointer to a idmef_tool_alert_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_correlation_alert_read ()

int         idmef_correlation_alert_read    (idmef_correlation_alert_t *correlation_alert,
                                             prelude_msg_t *msg);

Read an idmef_correlation_alert from the msg message, and store it into correlation_alert.

correlation_alert : Pointer to a idmef_correlation_alert_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_overflow_alert_read ()

int         idmef_overflow_alert_read       (idmef_overflow_alert_t *overflow_alert,
                                             prelude_msg_t *msg);

Read an idmef_overflow_alert from the msg message, and store it into overflow_alert.

overflow_alert : Pointer to a idmef_overflow_alert_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_alert_read ()

int         idmef_alert_read                (idmef_alert_t *alert,
                                             prelude_msg_t *msg);

Read an idmef_alert from the msg message, and store it into alert.

alert : Pointer to a idmef_alert_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_heartbeat_read ()

int         idmef_heartbeat_read            (idmef_heartbeat_t *heartbeat,
                                             prelude_msg_t *msg);

Read an idmef_heartbeat from the msg message, and store it into heartbeat.

heartbeat : Pointer to a idmef_heartbeat_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.

idmef_message_read ()

int         idmef_message_read              (idmef_message_t *message,
                                             prelude_msg_t *msg);

Read an idmef_message from the msg message, and store it into message.

message : Pointer to a idmef_message_t object.
msg : Pointer to a prelude_msg_t object, containing a message.
Returns : 0 on success, a negative value if an error occured.