Building Collector Plugins 1.1 - AlienVault

Building Collector Plugins - Admin Guide
2.4 Aliases
2.4.1 Path
/etc/ossim/agent/aliases.cfg
2.4.2 Predefined Regular Expressions
The predefined regular expressions can be used when creating new plugins.
IPV4= \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
MAC= \w{1,2}:\w{1,2}:\w{1,2}:\w{1,2}:\w{1,2}:\w{1,2}
PORT= \d{1,5}
TIME=
\d\d:\d\d:\d\d
SYSLOG_DATE= \w{3}\s+\d{1,2}\s\d\d:\d\d:\d\d
SYSLOG_WY_DATE= \w+\s+\d{1,2}\s\d{4}\s\d\d:\d\d:\d\d
To use an Alias in the regular expression use the \IPV4, \MAC, \SYSLOG_DATE, etc.
2.5 Functions
2.5.1 Path
/usr/share/ossim-agent/ossim_agent/ParserUtil.py
2.5.2 Conversions
resolv(host):
resolv_ip(addr):
resolv_port(port):
normalize_date(date):
normalize_protocol(proto):
md5sum(datastring):
upper(string):
hextoint(string):
translates a host name to an IPv4 address
translates an IPv4 address to a host name
translate a port name into its number
convert date strings to isoformat (must tag the regular expressions
with the following: , , , , ,
or for timestamps. To define new date
formats add a new regexp to the DATE_REGEXPS array.
translates the protocols to the protocol numbers, based on the
PROTO_TABLE
calculates the md5 checksum
all upper case
get the integer value of a hexadecimal number
Page 16 Copyright © Alienvault 2010