On Fri, Dec 5, 2014 at 3:19 PM, Brent Morris <[email protected]> wrote: > Wish I could edit that last post! > > I forgot a few lines.... complete local_decoder.xml below. > > add the following to local_decoder.xml > > > <decoder name="pfsvc-auth"> > <program_name>^pfsvc</program_name> > </decoder> > > <decoder name="pfsvc-authentication"> > <parent>pfsvc-auth</parent> > <regex offset="after_parent">Pfauth \w+ for user '(\S+)'. Call status: > (\S+) - "\w+\s+\w+|\w+\s+\w+\s+\w+\.".</regex> > <order>srcuser, status</order> > </decoder> >
Awesome stuff! Can you provide some log samples? > > > On Friday, December 5, 2014 11:51:18 AM UTC-8, Brent Morris wrote: >> >> Not exactly sure if this is the right place to post this, but it took me >> some time to get working decodes for Microsoft's Azure Multi-Factor >> Authentication (PhoneFactor.net). >> >> It's pretty cool multifactor authentication for on-prem RDP Gateway and >> OWA using your phone as the second factor. >> >> This was my first attempt to create my own decodes for an app that wasn't >> supported by OSSEC. OSSEC is so cool that I wanted to share these with >> others incase there might be one or two of you out there that could benefit. >> We're not using the APP or voice calls, but it shouldn't be to hard with the >> info below to setup the rest of the options for those. >> >> You could have the agent monitor the log files, or setup syslog inside the >> PhoneFactor app. I opted for syslog messages. >> >> And let me know if I'm posting in the wrong place, have an error in my >> decodes, or anything else helpful. >> >> Thanks! >> >> --- >> >> >> >> add the following to local_decoder.xml >> >> <decoder name="pfsvc-authentication"> >> <parent>pfsvc-auth</parent> >> <regex offset="after_parent">Pfauth \w+ for user '(\S+)'. Call status: >> (\S+) - "\w+\s+\w+|\w+\s+\w+\s+\w+\.".</regex> >> <order>srcuser, status</order> >> </decoder> >> >> then add the following to local_rules.xml (tailor to your specific needs). >> >> <group name="syslog,pfauth,"> >> <rule id="100140" level="0"> >> <decoded_as>pfsvc-auth</decoded_as> >> <description>Phone Factor Authentication app group.</description> >> </rule> >> <rule id="100141" level="10"> >> <if_sid>100140</if_sid> >> <match>FAILED_SMS_OTP_INCORRECT</match> >> <description>User Failed SMS Challenge/Response</description> >> </rule> >> </group> >> >> --end local_rules.xml > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
