Building Collector Plugins 1.1 - AlienVault

Building Collector Plugins - Admin Guide
2.7 Rules
The Rules define the format of each event and how they are normalized. It is composed by a regular
expression and the list of fields that the event will include once it is sent to the OSSIM Server.
In some cases only one regular expression will collect every event coming from one application, in
some other cases more than one rule will be required.
2.7.1 Evaluation Order
Rules are loading in alphabetical order based on the name given to each rule (Rule ID).
Once the log matches the regex of one rule the ossim agent stops processing the event, therefore
generic rules must be the last to be evaluated.
2.7.2 Structure
o
Name / Rule ID
The name of the rule is mandatory
o
Regular Expression
The regexp field contains the regular expression that defines the format of the events, and
extracts the information to normalize the event.
The regular expression has to be written following Python regular expression syntax:
http://docs.python.org/library/re.html
The information extracted by the regular expression from the log can be accessed by:
Position: (\d\d):(\d\d):(\d\d)
hour={$1}
minutes ={$2}
seconds={$3}
Tags: (?P\d\d):(?P\d\d)(?P\d\d)
hour={$hour}
minutes ={$minutes}
seconds={$seconds}
o
Normalized Fields
As the server must receive normalized events, where IP addresses for instance are using the
IPV4 format and the date uses the format YYYY-MM-DD HH:MM:SS (2010-12-31 22:57:00)
To simplify the process of normalizing events functions are defined (more details on
functions can be found in the “Functions” section of this document):
resolv()
Translates hostnames into IPV4 addresses (DNS queries)
Page 19 Copyright © Alienvault 2010