----- Original Message -----
> ----- Original Message -----
> > Hi Phil,
> >
> > On Tue, Feb 8, 2011 at 7:23 AM, --[ UxBoD ]-- <[email protected]>
> > wrote:
> > > Dan,
> > >
> > > I think I see what I did wrong and have changed it now to use two
> > > rules:
> > >
> > > <rule id="10044" level="0">
> > > <if_sid>5720</if_sid>
> > > <same_source_ip />
> > > <description>Multiple SSHD authentication failures
> > > (Local)</description>
> > > <group>authentication_failures,</group>
> > > </rule>
> > >
> >
> > You don't need the same_source_ip option. That only really matters
> > when you're looking for multiple events from the same IP.
> > You may need to raise the level to 1, I don't know. I've never
> > tried
> > this with a level 0 event.
> >
> > > <rule id="10044" level="10" frequency="24" timeframe="180">
> > > if_matched_sid>10044</if_matched_sid>
> > > <same_source_ip />
> > > <description>Multiple SSHD authentication failures
> > > (Local)</description>
> > > <group>authentication_failures,</group>
> > > </rule>
> > >
> >
> > You duplicated the rule id, this one should be 10045. Other than
> > that
> > it looks good.
> >
> > > So the first rule stops it from reporting and if that has been
> > > hit
> > > the second correlates them again the frequency.
> > >
> > > Is that the correct understanding ?
> > >
> > > Thanks.
> > >
> >
> > That looks correct to me.
> >
> Thanks Dan. Yeah I copied and pasted my thoughts hence the rule id
> dupe :) Are okay so for the first rule I remove same_source_ip and
> then use it in the correlated rule. That makes perfect sense.
>
Hmmm, this is still not working. Here are the rules I am testing with:
<rule id="10044" level="1">
<if_sid>5720</if_sid>
<description>Multiple SSHD authentication failures (Override
Generic)</description>
<group>authentication_failures,</group>
</rule>
<rule id="10061" level="10" frequency="4" timeframe="180">
<if_matched_sid>10044</if_matched_sid>
<same_source_ip />
<description>Multiple SSHD authentication failures - GLPI #493</description>
<group>authentication_failures,</group>
</rule>
Rule 5720 has a frequency of 6 set against it so my understand is that if
somebody got their password wrong that number of times then the rule should
fire. It would then be suppressed by my local rule 10044 and finally matched by
10061. That would only trigger the level 10 active response alert if it was to
receive 4 alerts matching rule 10044; which is 24 wrong password entries within
3 minutes.
I entered my password wrong 40 times within three minutes and rule 10061 next
fired.
What am I missing ? Is it possible to test correlated rules with ossec-logtest ?
Thanks, Phil
