idmef-message-read
Reading a message from a #prelude_msg_t buffer
Once you read a #prelude_msg_t object, you need to decode this message.
In case this is an IDMEF style message, the following API allow to read
the relevant IDMEF fields from the #prelude_msg_t object, and create the
IDMEF object from it's content.
The function you're most probably looking to use is idmef_message_read(), and here
is an example on how to use it:
int ret;
prelude_msg_t *pmsg;
idmef_message_t *message;
pmsg = whatever_method_to_get_a_prelude_msg();
ret = idmef_message_new(&message);
if ( ret < 0 )
return ret;
ret = idmef_message_read(message, pmsg);
This will decode the full IDMEF message stored within pmsg into the #idmef_message_t
IDMEF object and it's childrens.
@additional_data:
@msg:
@Returns:
@reference:
@msg:
@Returns:
@classification:
@msg:
@Returns:
@user_id:
@msg:
@Returns:
@user:
@msg:
@Returns:
@address:
@msg:
@Returns:
@process:
@msg:
@Returns:
@web_service:
@msg:
@Returns:
@snmp_service:
@msg:
@Returns:
@service:
@msg:
@Returns:
@node:
@msg:
@Returns:
@source:
@msg:
@Returns:
@file_access:
@msg:
@Returns:
@inode:
@msg:
@Returns:
@checksum:
@msg:
@Returns:
@file:
@msg:
@Returns:
@linkage:
@msg:
@Returns:
@target:
@msg:
@Returns:
@analyzer:
@msg:
@Returns:
@alertident:
@msg:
@Returns:
@impact:
@msg:
@Returns:
@action:
@msg:
@Returns:
@confidence:
@msg:
@Returns:
@assessment:
@msg:
@Returns:
@tool_alert:
@msg:
@Returns:
@correlation_alert:
@msg:
@Returns:
@overflow_alert:
@msg:
@Returns:
@alert:
@msg:
@Returns:
@heartbeat:
@msg:
@Returns:
@message:
@msg:
@Returns: