Do you have ossec setup to watch the httpd_err.log? Running it through
ossec-logtest I get the following output:
**Phase 1: Completed pre-decoding.
full event: '[Sun Sep 27 23:58:07 2009] [error] [client
126.10.10.1] ModSecurity: Warning. Pattern match
"(?:"\\s*\\*.+(?:or|id)\\W*"\\d)|(?:\\^")|(?:^[\\w\\s"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:"[\\s\\d]*[^\\w\\s]+\\W*\\d\\W*.*["\\d])|(?:"\\s*[^\\w\\s?]+\\s*[^\\w\\s]+\\s*")|(?:"\\s*[^\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:".*\\*\\s*\\d)|(?:"\\s*o
..." at REQUEST_URI_RAW. [file
"/system/webfam/apache/conf.d/modsecurity/base_rules/modsecurity_crs_31_ids.psv.conf"]
[line "109"] [id "phpids-43"] [msg "Detects classic SQL injection
probings 2/2"] [tag "WEB_ATTACK"] [hostname "server-webfarm-1"]
[uri"/buy/Pizza"] [unique_id "SsBefwoBBG8AAF2PGwYAAABc"]'
hostname: 'hostname'
program_name: '(null)'
log: '[error] [client 126.10.10.1] ModSecurity: Warning.
Pattern match
"(?:"\\s*\\*.+(?:or|id)\\W*"\\d)|(?:\\^")|(?:^[\\w\\s"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:"[\\s\\d]*[^\\w\\s]+\\W*\\d\\W*.*["\\d])|(?:"\\s*[^\\w\\s?]+\\s*[^\\w\\s]+\\s*")|(?:"\\s*[^\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:".*\\*\\s*\\d)|(?:"\\s*o
..." at REQUEST_URI_RAW. [file
"/system/webfam/apache/conf.d/modsecurity/base_rules/modsecurity_crs_31_ids.psv.conf"]
[line "109"] [id "phpids-43"] [msg "Detects classic SQL injection
probings 2/2"] [tag "WEB_ATTACK"] [hostname "server-webfarm-1"]
[uri"/buy/Pizza"] [unique_id "SsBefwoBBG8AAF2PGwYAAABc"]'
**Phase 2: Completed decoding.
decoder: 'apache-errorlog'
srcip: '126.10.10.1'
**Phase 3: Completed filtering (rules).
Rule id: '30101'
Level: '0'
Description: 'Apache error messages grouped.'
You could write a rule looking for maybe "Warning. Pattern match" and
"REQUEST_URI_RAW" or something.
Make sure to if_sid it to 30101.
Dan
On Thu, Oct 1, 2009 at 12:19 AM, OSSEC junkie <[email protected]> wrote:
>
> What is the best way to get an alert for a particular event in the
> Apache logs? Let's say I want to get e-mail alerts for "Pattern
> match"...and all data included in that event, is that possible? If so,
> how?
> For example, lets say I get an alert in my httpd_err.log that looks like this:
> [Sun Sep 27 23:58:07 2009] [error] [client 126.10.10.1] ModSecurity:
> Warning. Pattern match
> "(?:"\\s*\\*.+(?:or|id)\\W*"\\d)|(?:\\^")|(?:^[\\w\\s"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:"[\\s\\d]*[^\\w\\s]+\\W*\\d\\W*.*["\\d])|(?:"\\s*[^\\w\\s?]+\\s*[^\\w\\s]+\\s*")|(?:"\\s*[^\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:".*\\*\\s*\\d)|(?:"\\s*o
> ..." at REQUEST_URI_RAW. [file
> "/system/webfam/apache/conf.d/modsecurity/base_rules/modsecurity_crs_31_ids.psv.conf"]
> [line "109"] [id "phpids-43"] [msg "Detects classic SQL injection
> probings 2/2"] [tag "WEB_ATTACK"] [hostname "server-webfarm-1"] [uri
> "/buy/Pizza"] [unique_id "SsBefwoBBG8AAF2PGwYAAABc"]
>
> How could I get alerts for this with Ossec?
>
