Building Collector Plugins 1.1 - AlienVault

Building Collector Plugins - Admin Guide
[config]
type:
enable:
source:
location:
create_file:
process:
start:
stop:
startup:
shutdown:
exclude_sids=SID List
Example (hp-eva):
detector
process=snmptrapd
start=yes
stop=yes
startup=/etc/init.d/snmpd start
shutdown=/etc/init.d/snmpd stop
exclude_sids=404,200,403
Enable or Disable the plugin (It must be enabled in config.cfg)
Source of the events (log, mssql, mysql, wmi)
The file(s) where the logs can be found - can contain multiple
comma-separated files
Create the log file in case it does not exist
Name of the process generating logs (If on the same system)
Start the process when the agent starts (yes/no)
Stop the process when the agent stops (yes/no)
Command that starts the process
Command that stops the process
Use this option to exclude SIDs
[translation]
string=value
Used to map strings to their corresponding values
Example (Postfix):
[translation]
sent=10
bounced=11
[Rule IDs – Specific Rules]
Here are the events collected and normalized.
event_type=event
regexp=Regular Expression
plugin_sid=Plugin SID
Event_Field=Value
Example(ssh):
[01 - Failed password]
event_type=event
regexp="(\SYSLOG_DATE)\s+(?P[^\s]*).*?ssh.*?Failed password for inval
user (?P\S+)\s+from\s+.*?(?P\IPV4).*?port\s+(?P\PORT)"
plugin_sid=1
date={normalize_date($1)}
Page 14 Copyright © Alienvault 2010