Hi Dan,
Thanks for the quick response.
The objective is to create a rule that will trigger if a restricted package
is installed on the system. This is what I've done so far:
1. Created a custom decoder for Yum. This works fine. The logs are
decoded properly and the name of the package that is installed is decoded
and stored in "id"
2. Created a cdb file; placed the cdb file in /var/ossec/rules/; and
updated ossec.conf to include <list>cdb-list</list> under the rules
section. The cdb file compiles as expected
3. Created a custom rule (see below)
4. Run ossec-logtest (the output of logtest is below).
The rule is getting called but the alert never fires, see the output below.
======RULES================
<group name="syslog,yum,">
<rule id="110000" level="0">
<decoded_as>yum</decoded_as>
<description>Yum custom group.</description>
</rule>
<rule id="110001" level="10">
<if_sid>110000</if_sid>
<list field="id" lookup="match_key" >cdb-list</list> -->
<description>illegal package installed via Yum!!!</description>
</rule>
</group>
===============================
========Logtest Output==================
# ./ossec-logtest -vvv
2016/12/07 13:14:07 ossec-testrule: INFO: Reading local decoder file.
2016/12/07 13:14:07 ossec-testrule: INFO: Reading the lists file: 'cdb-list'
2016/12/07 13:14:07 ossec-testrule: INFO: Started (pid: 8075).
ossec-testrule: Type one log per line.
Dec 7 07:05:06 ax yum: Installed: libX11-devel - 1.0.3-9.el5.i386
**Phase 1: Completed pre-decoding.
full event: 'Dec 7 07:05:06 ax yum: Installed: libX11-devel -
1.0.3-9.el5.i386'
hostname: 'ax'
program_name: 'yum'
log: 'Installed: libX11-devel - 1.0.3-9.el5.i386'
**Phase 2: Completed decoding.
decoder: 'yum'
id: 'libX11-devel'
**Rule debugging:
Trying rule: 1 - Generic template for all syslog rules.
*Rule 1 matched.
*Trying child rules.
Trying rule: 600 - Active Response Messages Grouped
Trying rule: 110000 - Yum custom group.
*Rule 110000 matched.
*Trying child rules.
Trying rule: 110001 - illegal package installed via Yum!!!
**Phase 3: Completed filtering (rules).
Rule id: '110000'
Level: '0'
Description: 'Yum custom group.'
==============================================
--
*The information contained in or attached to this email is strictly
confidential. If you are not the intended recipient, please notify us
immediately by telephone and return the message to us.*
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
