Great stuff, thanks for sharing. On Fri, Dec 5, 2014 at 11:51 AM, Brent Morris <[email protected]> wrote:
> Not exactly sure if this is the right place to post this, but it took me > some time to get working decodes for Microsoft's Azure Multi-Factor > Authentication (PhoneFactor.net). > > It's pretty cool multifactor authentication for on-prem RDP Gateway and > OWA using your phone as the second factor. > > This was my first attempt to create my own decodes for an app that wasn't > supported by OSSEC. OSSEC is so cool that I wanted to share these with > others incase there might be one or two of you out there that could > benefit. We're not using the APP or voice calls, but it shouldn't be to > hard with the info below to setup the rest of the options for those. > > You could have the agent monitor the log files, or setup syslog inside the > PhoneFactor app. I opted for syslog messages. > > And let me know if I'm posting in the wrong place, have an error in my > decodes, or anything else helpful. > > Thanks! > > --- > > > > add the following to local_decoder.xml > > <decoder name="pfsvc-authentication"> > <parent>pfsvc-auth</parent> > <regex offset="after_parent">Pfauth \w+ for user '(\S+)'. Call status: > (\S+) - "\w+\s+\w+|\w+\s+\w+\s+\w+\.".</regex> > <order>srcuser, status</order> > </decoder> > > then add the following to local_rules.xml (tailor to your specific needs). > > <group name="syslog,pfauth,"> > <rule id="100140" level="0"> > <decoded_as>pfsvc-auth</decoded_as> > <description>Phone Factor Authentication app group.</description> > </rule> > <rule id="100141" level="10"> > <if_sid>100140</if_sid> > <match>FAILED_SMS_OTP_INCORRECT</match> > <description>User Failed SMS Challenge/Response</description> > </rule> > </group> > > --end local_rules.xml > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
