Hi all,
I am doing some tests sending checkpoint fw logs to ossec vi syslog
and the default checkpoint decoder provided by ossec 2.6 doesn't works.
For example using log explained in decoder.xml:
2012/04/30 10:26:13 ossec-testrule: INFO: Reading local decoder file.
2012/04/30 10:26:13 ossec-testrule: INFO: Reading loading the lists
file: 'lists/dshield_list'
2012/04/30 10:26:13 ossec-testrule: INFO: Reading loading the lists
file: 'lists/rbn_host_list'
2012/04/30 10:26:13 ossec-testrule: INFO: Reading loading the lists
file: 'lists/rbn_subnet_list'
2012/04/30 10:26:13 ossec-testrule: INFO: Started (pid: 7884).
ossec-testrule: Type one log per line.
Checkpoint: 21Aug2007 14:49:26 drop 10.10.10.1 >eth4 rule: 102;
rule_uid: {00000000-0000-0000-0000-000000000000}; ICMP: Echo Request;
src: 10.10.10.2; dst: 10.10.10.3; proto: icmp; ICMP Type: 8; ICMP Code:
0; product: VPN-1 & FireWall-1;
**Phase 1: Completed pre-decoding.
full event: 'Checkpoint: 21Aug2007 14:49:26 drop 10.10.10.1
>eth4 rule: 102; rule_uid: {00000000-0000-0000-0000-000000000000};
ICMP: Echo Request; src: 10.10.10.2; dst: 10.10.10.3; proto: icmp; ICMP
Type: 8; ICMP Code: 0; product: VPN-1 & FireWall-1;'
hostname: 'plzfsgsip02'
program_name: '(null)'
log: 'Checkpoint: 21Aug2007 14:49:26 drop 10.10.10.1 >eth4
rule: 102; rule_uid: {00000000-0000-0000-0000-000000000000}; ICMP: Echo
Request; src: 10.10.10.2; dst: 10.10.10.3; proto: icmp; ICMP Type: 8;
ICMP Code: 0; product: VPN-1 & FireWall-1;'
**Phase 2: Completed decoding.
No decoder matched.
Using a real sample:
Checkpoint: 30Apr2012 9:52:24 accept 172.23.4.3 >Lan2 rule: 54;
rule_uid: {9FF8FDBD-D83B-4AF2-AA55-29E72F37DEC2}; service_id: https;
src: 192.168.74.18; dst: 10.200.101.207; proto: tcp; product: VPN-1 &
FireWall-1; service: 443; s_port: 1111;
**Phase 1: Completed pre-decoding.
full event: 'Checkpoint: 30Apr2012 9:52:24 accept 172.23.4.3
>Lan2 rule: 54; rule_uid: {9FF8FDBD-D83B-4AF2-AA55-29E72F37DEC2};
service_id: https; src: 192.168.74.18; dst: 10.200.101.207; proto: tcp;
product: VPN-1 & FireWall-1; service: 443; s_port: 1111;'
hostname: 'ossecsrv02'
program_name: '(null)'
log: 'Checkpoint: 30Apr2012 9:52:24 accept 172.23.4.3 >Lan2
rule: 54; rule_uid: {9FF8FDBD-D83B-4AF2-AA55-29E72F37DEC2}; service_id:
https; src: 192.168.74.18; dst: 10.200.101.207; proto: tcp; product:
VPN-1 & FireWall-1; service: 443; s_port: 1111;'
**Phase 2: Completed decoding.
No decoder matched.
Where is the problem??
--
CL Martinez
carlopmart {at} gmail {d0t} com
