I'm scouring google for samples. I'll have something by the end of the week that should handle more cases than the current and proposed solutions...
On Sun, Oct 31, 2010 at 10:55 PM, Jason 'XenoPhage' Frisvold <[email protected]> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Oct 28, 2010, at 3:08 PM, blacklight wrote: >> The syslog message was generated on a Linux 2.6 machine serving as an >> OSSEC agent host. The Linux 2.6 machine is running Fedora Core 5. > > Isn't FC5 a tad old? > >> I worked with this host because it is accessible from the outside and >> it was being bombed with FTP login requests from a single, unknown >> external IP. >> >> I expect that this solution works out for all out hosts because we are >> pretty much standardized on Linux 2.6 - both Fedora Core 5 and Centos >> 5 - if we were not standardized, I'd go crazy :) > > Your fix works, sort of. It appears that this line : > > <regex offset="after_prematch">[(\d+.\d+.\d+.\d+)]$</regex> > > Expects something along the lines of : > > [123.123.123.123] > > while your log message doesn't have the square brackets, are there other > instances that would? If the rule is switched to use (\S+) instead, then > srcip will have extra characters in it that will cause the active response to > fail. Instead, try this : > > <regex offset="after_prematch">(\d+.\d+.\d+.\d+)</regex> > > This will match the first IP address after the prematch. It should catch the > log entries you have provided as well as those that may have square brackets. > > - --------------------------- > Jason 'XenoPhage' Frisvold > [email protected] > - --------------------------- > "Any sufficiently advanced magic is indistinguishable from technology." > - - Niven's Inverse of Clarke's Third Law > > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.14 (Darwin) > > iEYEARECAAYFAkzOLCEACgkQ8CjzPZyTUTRgmgCdEwDiGbaLs/hRSxCFRgM7sWFR > zeQAn2JmDCtXFcHyG3vQOMM7Sd0OCvDW > =TlMq > -----END PGP SIGNATURE----- >
