[ossec-list] Testing OSSEC rules

[Daniel Cid]

Hi list,

I just posted on my blog about a very useful tool (available on CVS)
to test the rules/decoders in real time.
If you ever need to write or change rules, it can save a lot of time.

If you are interested, take a look at: http://www.ossec.net/dcid/?p=136


Part of the output from logtest, when run against a sshd message:


"
     # ./ossec-logtest
    2008/07/04 09:57:28 ossec-testrule: INFO: Started (pid: 12683).
    ossec-testrule: Type one log per line.

    Jul 4 09:42:16 enigma sshd[11990]: Accepted password for dcid from
192.168.2.10 port 35259 ssh2

    **Phase 1: Completed pre-decoding.
    full event: 'Jul 4 09:42:16 enigma sshd[11990]: Accepted password
for dcid from 192.168.2.10 port 35259 ssh2′
    hostname: 'enigma'
    program_name: 'sshd'
    log: 'Accepted password for dcid from 192.168.2.10 port 35259 ssh2′

    **Phase 2: Completed decoding.
    decoder: 'sshd'
    dstuser: 'dcid'
    srcip: '192.168.2.10′

    **Phase 3: Completed filtering (rules).
    Rule id: '10100′
    Level: '4′
    Description: 'First time user logged in.'
    **Alert to be generated.
"

Hope it helps.


--
Daniel B. Cid
dcid ( at ) ossec.net