Hi Shane, On Wed, Jan 26, 2011 at 11:47 AM, Castle, Shane <[email protected]> wrote: > Earlier this year there was an interchange about getting Trend Micro > OfficeScan notices into OSSEC. There is a rule file for this > (trend-osce_rules.xml) but it seems not to be triggered, perhaps owing > to the fact that OfficeScan no longer puts these into an ASCII file > anymore, but does put them into a database. OfficeScan can also be > configured to put its notifications into the Windows Event logs. Here is > one example, from the server's application log: > > Event Type: Warning > Event Source: Trend Micro OfficeScan Server > Event Category: System > Event ID: 10 > Date: 1/25/2011 > Time: 16:49:33 > User: NT AUTHORITY\SYSTEM > Computer: VIRUSSCAN1 > Description: > Virus/Malware: Eicar_test_file > Computer: IT114909 > Domain: Boco > File: C:\DOCUME~1\scastle\LOCALS~1\Temp\JU5oa5aH.zip.part (eicar.com) > Date/Time: 1/25/2011 16:49:31 > Result: Virus successfully detected, cannot perform the Clean action > (Delete) > > These should be decoded by the Windows Event log decoder, but they don't > seem to be picked up by the rules in trend-osce_rules.xml. What needs to > change so that this can happen? I'm willing to do the work; I just need > to be pointed in the right direction. > > -- > Shane Castle > Data Security Mgr, Boulder County IT > CISSP GSEC GCIH > > >
To start with you need to get a copy of the log as OSSEC sees it. The easiest way I know of is to turn on <logall> in ossec.conf on the manager in the <global> section: <global> <logall>yes</logall> </global> This will log ALL log messages to /var/ossec/logs/archives/archives.log. Once you have one of these log messages (you'll have to trim a small header off of the message, I think the header ends after the '->'), you can use ossec-logtest to see how the message is decoded by OSSEC. Then you need to modify the rules and possibly decoder accordingly. With a sample log or two I can help a bit more by providing more information.
