What does ossec-logtest respond with on the sample below? 2014-12-12 21:00:55 W3SVC1 IIS8-5Server 1.2.3.4 GET /cmd.exe - 443 - 2.3.4.5 HTTP/1.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - - IIS8-5Server 404 0 2 1477 256 0
There's either an issue with the IIS logs, or an issue with OSSEC. Can you provide a sample of the log with the SQL injection that isn't picked up by web rules? Also, could you provide the relevant portion of a URL you use to test a SQL injection attack? I'll try it on my systems and perhaps we can compare the logs to figure out where the issue is. On Monday, December 22, 2014 11:40:30 AM UTC-8, James Whittington wrote: > >> I've tested on IIS 7.5 and IIS 8.5, and both systems work flawlessly > >> for the built-in decoders in OSSEC. I even tested with Nexpose and > >> they both work. > > >Can you please post a log sample that you know decodes properly and for > which the rules hit as they should? It would be nice to get to the bottom > of >this. > > I haven't seen a log sample of IIS 7.5 and IIS 8.5 "flawlessly" decoding > and triggering on default web rules so I was hoping someone would step up > and show a decoded IIS log triggering on a web rule. > > From what I can tell on a logtest only the parent decoder displays so I > think it would be tricky to know for sure which decoder was used last. > > I checked log samples from IIS 7, IIS 8, ISS 8 in the azure cloud and they > all extract URL at least, but none seem to trigger on a simple SQL > injection rule > I had been previously advised that the documentation says all log fields > must be checked (Yep did that a couple of years ago but I double checked > anyway). > I have also heard to just use something else to analyze IIS log events > (and this is likely the best path for me at this point). > > I like the flexibility OSSEC gives me but I am pretty darn sure IIS logs > will not trigger on web rules which is a shame. > > I guess I must be in the minority with using OSSEC to monitor IIS logs, or > something in my setup is wrong, or folks just assume OSSEC is helping them > watch IIS logs. > > I am just putting this topic back out there in case anything new had > happened with it. > > James Whittington > > > > -----Original Message----- > From: [email protected] <javascript:> [mailto: > [email protected] <javascript:>] On Behalf Of Michael Starks > Sent: Saturday, December 13, 2014 11:50 > To: [email protected] <javascript:> > Subject: Re: [ossec-list] Re: anyone know the status of the issue where > IIS logs are not able to trigger on web_rules.xml > > On 12/12/2014 06:02 PM, Brent Morris wrote: > > It should be noted that the decoders seem fine for me (and I suspect > > everyone else). I think that github issue is bogus. > > I think it is correct, but of course I could have made a mistake. > > > Follow what I posted above... basically, IIS Manager > Default Web > > Site > >> Logging > Log File Format: W3C - select fields. *Check all the > >> boxes > > that are not checked*!!!!! I think there were 4 that weren't checked. > > > > Edit your OSSEC config on that box... > > > > <localfile> > > <location>C:\inetpub\logs\LogFiles\W3SVC1\u_ex%y%m%d.log</location> > > <log_format>iis</log_format> > > </localfile> > > > > I've tested on IIS 7.5 and IIS 8.5, and both systems work flawlessly > > for the built-in decoders in OSSEC. I even tested with Nexpose and > > they both work. > > Can you please post a log sample that you know decodes properly and for > which the rules hit as they should? It would be nice to get to the bottom > of this. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] <javascript:>. > For more options, visit https://groups.google.com/d/optout. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
