That's an interesting question, it seems to me you are duplicating functionality between modsecurity and ossec. Ossec can match patterns in the http log by itself.
You could put this in local_rules.xml <rule id="130101" level="12"> <!-- any id over 10000, a high level to trigger alerting --> <if_sid>30101</if_sid> <!-- if it has matched 30101, as demonstrated by ddp in other email --> <match>WEB_ATTACK</match> <!-- string in your log message --> <description>apache error tagged by modsecurity</description> <group>automatic_attack,</group> <!-- or other groups as appropriate --> </rule> So if a log line matches 30101, then this rule 130101 will be run against it. It matches "WEB_ATTACK" so alert level is set to 12, which is sufficient to set off notification on a stock Ossec. I checked it with ossec-logtest, YMMV Hope this helps, Rick -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of OSSEC junkie Sent: Thursday, October 01, 2009 12:20 AM To: [email protected] Subject: [ossec-list] Alerting Configuration and Alerting for ModSecurity Events Importance: Low What is the best way to get an alert for a particular event in the Apache logs? Let's say I want to get e-mail alerts for "Pattern match"...and all data included in that event, is that possible? If so, how? For example, lets say I get an alert in my httpd_err.log that looks like this: [Sun Sep 27 23:58:07 2009] [error] [client 126.10.10.1] ModSecurity: Warning. Pattern match "(?:"\\s*\\*.+(?:or|id)\\W*"\\d)|(?:\\^")|(?:^[\\w\\s"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:"[\\s\\d]*[^\\w\\s]+\\W*\\d\\W*.*["\\d])|(?:"\\s*[^\\w\\s?]+\\s*[^\\w\\s]+\\s*")|(?:"\\s*[^\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:".*\\*\\s*\\d)|(?:"\\s*o ..." at REQUEST_URI_RAW. [file "/system/webfam/apache/conf.d/modsecurity/base_rules/modsecurity_crs_31_ids.psv.conf"] [line "109"] [id "phpids-43"] [msg "Detects classic SQL injection probings 2/2"] [tag "WEB_ATTACK"] [hostname "server-webfarm-1"] [uri "/buy/Pizza"] [unique_id "SsBefwoBBG8AAF2PGwYAAABc"] How could I get alerts for this with Ossec? This message contains TMA Resources confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version.
