I am trying to accomplish what I asked in my first post on this thread via
the below and I'm confused. Rules 100102 and 100103 work as I thought they
should. If I throw three logs with the same source IP rule 100102 fires.
If I throw three logs with different source IP but the same user then rule
100103 fires
After rule 100101 each pair of rules is configured to handle same_source_ip
then same_user for the same event ID. Rules 100104 and 100105 do not work
as the first pair of rules does even though they are set up the same. Rule
100105 is the one to always fire, even when the source IPs are the same
three times in a row. I see the same thing happening with rules 100106 and
100107. And, I have no idea why. Rules 100105 and 100107 should not fire
unless the source IPs are different, correct? I've probably been looking
at this too much and need a break.
*DECODERS in local_decoder.xml:*
Had to add
<decoder>etc/local_decoder.xml</decoder>
<decoder>etc/decoder.xml</decoder>
to ossec.conf to get these to work first thing under <rules>.
All of the decoders work as they should.
<decoder name="pix">
<prematch>^%PIX-|^\w\w\w \d\d \d\d\d\d \d\d:\d\d:\d\d: %PIX-|</prematch>
<prematch>^%ASA-|^\w\w\w \d\d \d\d\d\d \d\d:\d\d:\d\d: %ASA-|</prematch>
<prematch>^%FWSM-|^\w\w\w \d\d \d\d\d\d \d\d:\d\d:\d\d: %FWSM-</prematch>
</decoder>
<decoder name="pix_vpn_ipsec_logs">
<parent>pix</parent>
<prematch offset="after_parent">^3-713167:|^6-713228:</prematch>
<regex>ASA-(\S+):\.+Username\s+=\s+(\S+),\.+IP\s+=\s+(\S+),</regex>
<order>id, user, srcip</order>
</decoder>
<decoder name="pix_anyconnect_logs">
<parent>pix</parent>
<prematch offset="after_parent">^4-722051:</prematch>
<regex>ASA-(\S+):\.+User\s+\p(\S+)\p\s+IP\s+\p(\d+.\d+.\d+.\d+)\p</regex>
<order>id, user, srcip</order>
</decoder>
*RULES:*
<group name="syslog,pix,">
<rule id="100101" level="3">
<if_sid>4314</if_sid>
<id>^6-713228$</id>
<description>PIX notification/informational message raise alert level
from 0 set by rule 4314.</description>
</rule>
<rule id="100102" frequency="1" timeframe="900" level="10">
<if_matched_sid>4312</if_matched_sid>
<id>^3-713167$</id>
<same_source_ip />
<description>Multiple VPN failed logons from the same source
IP</description>
<options>alert_by_email</options>
</rule>
<rule id="100103" frequency="1" timeframe="1800" level="10">
<if_matched_sid>4312</if_matched_sid>
<id>^3-713167$</id>
<same_user />
<description>Multiple VPN failed logons for the same user but different
source IPs</description>
<options>alert_by_email</options>
</rule>
<rule id="100104" frequency="1" timeframe="900" level="10">
<if_matched_sid>4313</if_matched_sid>
<id>^4-722051$</id>
<same_source_ip />
<description>Multiple VPN logons from the same source IP</description>
<options>alert_by_email</options>
</rule>
<rule id="100105" frequency="1" timeframe="5400" level="15">
<if_matched_sid>4313</if_matched_sid>
<id>^4-722051$</id>
<same_user />
<description>Multiple VPN logons from the same user from different
source IPs</description>
<options>alert_by_email</options>
</rule>
<rule id="100106" frequency="1" timeframe="900" level="10">
<if_matched_sid>100101</if_matched_sid>
<id>^6-713228$</id>
<same_source_ip />
<description>Multiple VPN logons from the same source IP</description>
<options>alert_by_email</options>
</rule>
<rule id="100107" frequency="1" timeframe="7200" level="15">
<if_matched_sid>100101</if_matched_sid>
<id>^6-713228$</id>
<same_user />
<description>Multiple VPN logons from the same user from different
source IPs</description>
<options>alert_by_email</options>
</rule>
</group>
*SAMPLE LOGS:*
Sep 04 2014 17:00:31: %ASA-3-713167: Group = VPN_GROUP, Username = jsmith,
IP = 2.3.2.3, Remote peer has failed user authentication - check configured
username and password
Sep 05 2014 12:08:37: %ASA-4-722051: Group <VPN_GROUP> User <jsmith> IP
<2.3.2.3> IPv4 Address <10.5.4.6> IPv6 address <::> assigned to session
Sep 05 2014 12:00:29: %ASA-6-713228: Group = VPN_GROUP, Username = jsmith,
IP = 2.3.2.3, Assigned private IP address 10.5.4.6 to remote user
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
