/usr/lib/ is in prelude-correlator 1.0.0-1.1.
This file is owned by root:root, with mode 0o755.
..
/usr/lib/python2.7/
/usr/lib/python2.7/dist-packages/
/usr/lib/python2.7/dist-packages/PreludeCorrelator/
/usr/lib/python2.7/dist-packages/PreludeCorrelator/idmef.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/pluginmanager.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/log.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/utils.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/__init__.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/require.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/siteconfig.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/context.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/config.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/opensshauth.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/businesshour.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/firewall.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/__init__.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/bruteforce.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/spamhausdrop.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/dshield.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/scan.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/plugins/worm.py
/usr/lib/python2.7/dist-packages/PreludeCorrelator/main.py
/usr/lib/python2.7/dist-packages/prelude_correlator-1.0.0.egg-info/
/usr/lib/python2.7/dist-packages/prelude_correlator-1.0.0.egg-info/not-zip-safe
/usr/lib/python2.7/dist-packages/prelude_correlator-1.0.0.egg-info/PKG-INFO
/usr/lib/python2.7/dist-packages/prelude_correlator-1.0.0.egg-info/dependency_links.txt
/usr/lib/python2.7/dist-packages/prelude_correlator-1.0.0.egg-info/entry_points.txt
/usr/lib/python2.7/dist-packages/prelude_correlator-1.0.0.egg-info/top_level.txt