0

我正在将 OSSEC 用于 HIDS。

我创建了一个自定义解码器并从日志中提取字段，如srcip、dstip和protocol。

这是使用 ./ossec-logtest 测试的日志

Sep  2 14:39:23 rana-HP-Notebook kernel: [21261.042146] [UFW BLOCK] IN=wlp19s0 OUT= MAC=cc:b0:da:66:20:c3:00:23:15:d4:dd:70:08:00 SRC=192.153.41.125 DST=192.153.41.12 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=28858 PROTO=TCP SPT=2662 DPT=0 WINDOW=512 RES=0x00 URGP=0

为日志编写的解码器是：

<decoder name="iptables-blockedip">
   <parent>iptables</parent>
   <prematch offset="after_parent">^\S+ [UFW BLOCK] IN=\S+ OUT= MAC=\S+ </prematch>
   <regex offset="after_prematch">^SRC=(\S+) DST=(\S+) LEN=\S+ TOS=\S+ PREC=\S+ TTL=\S+ ID=\S+ PROTO=(\S+) SPT=(\S+) DPT=(\S+) WINDOW=\S+ RES=\S+ URGP=\S+$</regex>
   <order>srcip,dstip,protocol,srcport,dstport</order>
</decoder>

它的规则是：

<rule id="100002" level="8">
    <decoded_as>iptables</decoded_as>
    <description>An ip was blocked by the firewall</description>
 </rule>

这是 ossec-logtest 的结果

**Phase 1: Completed pre-decoding.
       full event: 'Sep  2 14:39:23 rana-HP-Notebook kernel: [21261.042146] [UFW BLOCK] IN=wlp19s0 OUT= MAC=cc:b0:da:66:20:c3:00:23:15:d4:dd:70:08:00 SRC=192.153.41.125 DST=192.153.41.12 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=28858 PROTO=TCP SPT=2662 DPT=0 WINDOW=512 RES=0x00 URGP=0'
       hostname: 'rana-HP-Notebook'
       program_name: 'kernel'
       log: '[21261.042146] [UFW BLOCK] IN=wlp19s0 OUT= MAC=cc:b0:da:66:20:c3:00:23:15:d4:dd:70:08:00 SRC=192.153.41.125 DST=192.153.41.12 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=28858 PROTO=TCP SPT=2662 DPT=0 WINDOW=512 RES=0x00 URGP=0'

**Phase 2: Completed decoding.
       decoder: 'iptables'
       srcip: '192.153.41.125'
       dstip: '192.153.41.12'
       proto: 'TCP'
       srcport: '2662'
       dstport: '0'

**Phase 3: Completed filtering (rules).
       Rule id: '100002'
       Level: '8'
       Description: 'An ip was blocked by the firewall'

现在主要的问题是：

是否可以将解码器中的 srcip 添加到规则描述中，以便在引发警报时将其显示在描述中。

我对 ossec-logtest 阶段 3 的预期结果是：

**Phase 3: Completed filtering (rules).
       Rule id: '100002'
       Level: '8'
       Description: 'An ip 192.153.41.125 was blocked by the firewall'
4

1 回答 1

0

您可以在说明中使用以下语法：$(field_name).

您的规则如下所示：

<rule id="100002" level="8">
    <decoded_as>iptables</decoded_as>
    <description>An ip $(srcip) was blocked by the firewall</description>
 </rule>

您可以在 Wazuh 文档中了解更多信息：https ://documentation.wazuh.com/3.13/user-manual/ruleset/ruleset-xml-syntax/rules.html#description

于 2020-09-02T14:20:09.100 回答