Building Collector Plugins 1.1 - AlienVault

Building Collector Plugins - Admin Guide
2.5.3 Application Specific Translations
snort_id(id):
intrushield_sid(sid,name):
netscreen_idp_sid(msg):
iss_siteprotector_sid(msg):
resolv_iface(iface):
adds 1000 to the Snort ID
all McAfee Intrushield IDs are divisible by 256, and this length
doesn't fit in the OSSIM table ( mcafee_sid =
hextoint(mcafee_sid)/256)
translates the Netscreen messages based on the
NETSCREEN_IDP_SID_TRANSLATION_TABLE translation table
(defined in ParserUtil.py)
translates the ISS_SiteProtector messages based on the
ISS_SITEPROTECTOR_SID_TRANSLATION_MAP translation table
(defined in ParserUtil.py)
normalize interface name to either “ext” or “int”
2.5.4 User Defined Translations
translate(string):
Example (from the iptables plugin):
# The translation section in the plugin configuration file
[translation]
ACCEPT=1
REJECT=2
DROP=3
DENY=3
Inbound=4
Outbound=5
# Rule ID
[0 - iptables]
translates strings based on the entries defined in the [translation]
section of the plugin.
# Log sample
# Oct 31 08:59:25 M2600001 kernel: RULE 0 -- ACCEPT IN= OUT=lo SRC=127.0.0.1
DST=127.0.0.1 LEN=60
# TOS=0x00 PREC=0x00 TTL=64 ID=8437 DF PROTO=TCP SPT=57275 DPT=836
SEQ=2806649400
# ACK=0 WINDOW=32767 RES=0x00 SYN URGP=0
# Log Parsing
regexp=(\S+\s+\d+\s+\d\d:\d\d:\d\d)\s+(\S*) (\S*):.*?(\S+)\s+IN=(\S*) OUT=(\S*) SRC=(\S+)
DST=(\S+) LEN=(\d+) \S+ \S+ TTL=(\d+) .*? PROTO=(\S*) SPT=(\d*) DPT=(\d*)
………
# plugin_sid is set to 1, the translated value for ACCEPT
plugin_sid={translate($4)}
Page 17 Copyright © Alienvault 2010