Building Collector Plugins 1.1 - AlienVault

More documents

Recommendations

Info

Building Collector Plugins - Admin Guide [Rule 05 - User Session Closed - IP] # Jul 14 19:26:25 dmz01 LOGON_EXAMPLE: > ossim pts/2 172.22.22.10 Wed Jul 14 19:26 - 19:26 (00:00) event_type=event regexp="^(?P(\S+\s+\d+\s+\d\d:\d\d:\d\d)\s+(?P[^\s]+)\s+LOGON_EXAMPLE: >\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P\IPV4)\s+(?P.*))$" sensor=\_CFG(plugin-defaults,sensor) date={normalize_date($1)} plugin_sid=4 username={$username} src_ip={$source} dst_ip={resolv($host)} userdata1={$tty} userdata2={md5sum($logline)} userdata3={$logline} userdata4={$logged_event} [Rule 06 - User Session Closed - hostname] # Jul 14 19:33:56 dmz01 LOGON_EXAMPLE: > root pts/2 localhost Wed Jul 14 19:33 - 19:33 (00:00) event_type=event regexp="^(?P(\S+\s+\d+\s+\d\d:\d\d:\d\d)\s+(?P[^\s]+)\s+LOGON_EXAMPLE: >\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?Plocalhost)\s+(?P.*))$" sensor=\_CFG(plugin-defaults,sensor) date={normalize_date($1)} plugin_sid=4 username={$username} src_ip=127.0.0.1 dst_ip={resolv($host)} userdata1={$tty} userdata2={md5sum($logline)} userdata3={$logline} userdata4={$logged_event} [Rule 07 - Reboot Detected] # Jul 14 20:15:09 dmz01 LOGON_EXAMPLE: > reboot system boot 2.6.31.6 Mon May 24 13:51 - 20:15 (51+06:23) event_type=event regexp="^(?P(\S+\s+\d+\s+\d\d:\d\d:\d\d)\s+(?P[^\s]+)\s+LOGON_EXAMPLE: >reboot.*))$" sensor=\_CFG(plugin-defaults,sensor) date={normalize_date($1)} plugin_sid=5 userdata1={md5sum($logline)} userdata2={$logline} userdata3={$generator} userdata4={$logged_event} [Rule 99 - Catch all] # Whatever doesn't match the above rules event_type=event regexp="^(?P(?P\S+\s+\d+\s+\d\d:\d\d:\d\d)\s+(?P[^\s]+)\s+LOGON_EXAMPLE:.*))$" sensor=\_CFG(plugin-defaults,sensor) date={normalize_date($date)} plugin_sid=99 userdata1={md5sum($logline)} userdata2={$logline} userdata3={$logged_event} Page 28 Copyright © Alienvault 2010
Building Collector Plugins - Admin Guide 5.2.8 Register the Plugin with the OSSIM Agent Add the example.cfg plugin to the agent configuration file opensourcesim:~# more /etc/ossim/agent/config.cfg [plugins] syslog=/etc/ossim/agent/plugins/syslog.cfg example=/etc/ossim/agent/plugins/example.cfg wmi-system-logger=/etc/ossim/agent/plugins/wmi-system-logger.cfg Alternatively the plugin can be activated with the ossim-setup utility: opensourcesim:~# ossim-setup 1) Change Sensor Settings 2) Select Detector Plugins 3) Select the “example” Plugin Page 29 Copyright © Alienvault 2010
Page 1 and 2: Building Collector Plugins Admin Gu
Page 3 and 4: Building Collector Plugins - Admin
Page 27: Building Collector Plugins - Admin
Page 31 and 32: 5.2.10 Check whether the plugin was

Building Collector Plugins 1.1 - AlienVault

Create successful ePaper yourself

Delete template?

Save as template?