From 91659275b5617c06a18043b34cfb33efd2b8b0be Mon Sep 17 00:00:00 2001 From: Chris Petersen Date: Fri, 1 Sep 2006 20:54:01 +0000 Subject: [PATCH 01/32] auto-import sec-2.3.3-4 on branch devel from sec-2.3.3-4.src.rpm --- .cvsignore | 1 + 001_init.sec | 19 +++ amavisd.sec | 18 +++ bsd-MONITOR.sec | 54 +++++++++ bsd-PHYSMOD.sec | 46 ++++++++ bsd-USERACT.sec | 76 ++++++++++++ clamav.sec | 8 ++ conf.README | 10 ++ cvs.sec | 36 ++++++ dameware.sec | 15 +++ dbi-example.sec | 25 ++++ general.sec | 302 +++++++++++++++++++++++++++++++++++++++++++++++ hp-openview.sec | 110 +++++++++++++++++ labrea.sec | 29 +++++ mpd.sec | 18 +++ pix-security.sec | 241 +++++++++++++++++++++++++++++++++++++ pix-url.sec | 75 ++++++++++++ portscan.sec | 40 +++++++ sec.init | 88 ++++++++++++++ sec.logrotate | 8 ++ sec.spec | 235 ++++++++++++++++++++++++++++++++++++ sec.sysconfig | 25 ++++ snort.sec | 157 ++++++++++++++++++++++++ snortsam.sec | 70 +++++++++++ sources | 1 + ssh-brute.sec | 67 +++++++++++ ssh.sec | 253 +++++++++++++++++++++++++++++++++++++++ syslog-ng.txt | 95 +++++++++++++++ vtund.sec | 71 +++++++++++ windows.sec | 37 ++++++ 30 files changed, 2230 insertions(+) create mode 100644 001_init.sec create mode 100644 amavisd.sec create mode 100644 bsd-MONITOR.sec create mode 100644 bsd-PHYSMOD.sec create mode 100644 bsd-USERACT.sec create mode 100644 clamav.sec create mode 100644 conf.README create mode 100644 cvs.sec create mode 100644 dameware.sec create mode 100644 dbi-example.sec create mode 100644 general.sec create mode 100644 hp-openview.sec create mode 100644 labrea.sec create mode 100644 mpd.sec create mode 100644 pix-security.sec create mode 100644 pix-url.sec create mode 100644 portscan.sec create mode 100755 sec.init create mode 100644 sec.logrotate create mode 100644 sec.spec create mode 100644 sec.sysconfig create mode 100644 snort.sec create mode 100644 snortsam.sec create mode 100644 ssh-brute.sec create mode 100644 ssh.sec create mode 100644 syslog-ng.txt create mode 100644 vtund.sec create mode 100644 windows.sec diff --git a/.cvsignore b/.cvsignore index e69de29..e066934 100644 --- a/.cvsignore +++ b/.cvsignore @@ -0,0 +1 @@ +sec-2.3.3.tar.gz diff --git a/001_init.sec b/001_init.sec new file mode 100644 index 0000000..2858f15 --- /dev/null +++ b/001_init.sec @@ -0,0 +1,19 @@ +### Logfile & global variable initialization + +type = Single +ptype = RegExp +pattern = (SEC_STARTUP|SEC_RESTART|SEC_SHUTDOWN) +desc = SEC internal message +action = assign %mailto root@localhost; \ + assign %logfile /var/log/sec; \ + shellcmd /bin/echo -e -- "\n%t %s : $0\n" >> %logfile; \ + add SECPROD %t "starting : %s / $0" + +### Daily SEC report + +type = Calendar +time = 44 4 * * * +desc = Daily report +action = add SECPROD %t "Mailing report : '%s' to %mailto"; \ + report SECPROD /bin/mail -s "SEC REPORT: %s" %mailto + diff --git a/amavisd.sec b/amavisd.sec new file mode 100644 index 0000000..d718395 --- /dev/null +++ b/amavisd.sec @@ -0,0 +1,18 @@ +#Amavisd events + + +#Sep 4 15:43:02 xxxxx clamd[581]: /var/amavisd/amavis-20050904T153955-46858/parts/part-00001: HTML.Phishing.Bank-1 FOUND +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND +desc=$0 +action=add GENERAL_REPORT CLAMD: $2 on $1 + +#Sep 4 00:02:46 xxxxx amavis[57825]: (57825-12) TROUBLE in check_mail: creating_partsdir FAILED: DBD::mysql::st execute failed: L +ost connection to MySQL server during query at (eval 53) line 238, line 1789. +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+amavis\[\d+\]: .* TROUBLE .* +desc=$0 +action=add GENERAL_REPORT AMAVISD: $1: %s + diff --git a/bsd-MONITOR.sec b/bsd-MONITOR.sec new file mode 100644 index 0000000..302e0de --- /dev/null +++ b/bsd-MONITOR.sec @@ -0,0 +1,54 @@ +# +# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# SEC rules to pick up disruptive monitoring +# events. +# +#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) +#---------------------------------------------------------------------- +#Nov 15 20:02:48 foohost syslogd: exiting on signal 15 +#Nov 22 02:00:02 foohost syslogd: restart +#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled +#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled +# + +# +# Syslog Exit +# ----------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+) +desc=$0 +action=write - MONITOR: $1 syslog exit on signal $2 at %t + +# +# Syslog Restart +# --------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart +desc=$0 +action=write - MONITOR: $1 syslog restart at %t + +# +# Syslog Exit +# ----------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+) +desc=$0 +action=write - MONITOR: $1 $2 promiscuous mode $3 at %t + +# +# Swapspace failure +# + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+kernel: swap_pager_getswapspace\(\S\): .* +desc=$0 +action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@yourdomain.com + diff --git a/bsd-PHYSMOD.sec b/bsd-PHYSMOD.sec new file mode 100644 index 0000000..bb44dea --- /dev/null +++ b/bsd-PHYSMOD.sec @@ -0,0 +1,46 @@ +# +# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# PHYSMOD.conf - Events concerning physical modifications +# to the system. +# +# +#Logs involving physical modifications (PHYSMOD) +#------------------------------------------------ +#Nov 14 21:11:19 foohost /kernel: pccard: card inserted, slot 0 +#Nov 14 22:28:09 foohost /kernel: pccard: card removed, slot 0 +#Nov 12 19:46:31 foohost /kernel: de0: link down: cable problem? +#Nov 12 19:46:42 foohost /kernel: de0: autosense failed: cable problem? +#Oct 18 06:26:37 foohost pccardd[49]: ep0: 3Com Corporation (/3C589/) inserted. +#Oct 18 06:26:42 foohost pccardd[49]: pccardd started +# + +# +# PCMCIA Card Insertion, Removal +# -------------------------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pccard: card (\S+), slot (\d+) +desc=$0 +action=write - PHYSMOD: $1 pccard: card $2 in slot $3 at %t + +# +# PCMCIA Card Daemon +# -------------------------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+pccardd\[\d+\]: (.*) +desc=$0 +action=write - PHYSMOD: $1 pccardd: $2 at %t + +# +# Cabling Problem +# ---------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem +desc=$0 +action=write - PHYSMOD: $1 cable problem on $2, text: $3 at %t diff --git a/bsd-USERACT.sec b/bsd-USERACT.sec new file mode 100644 index 0000000..44227a9 --- /dev/null +++ b/bsd-USERACT.sec @@ -0,0 +1,76 @@ +# +# From http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# Events concerning user activities. +# +#Logs involving logins, change of UID and privilege escalations (USERACT) +#------------------------------------------------------------------------- +#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1 +#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100 +#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for jpb from 192.168.1.1 port 1077 ssh2 +#Nov 14 12:55:29 foohost sshd[3425]: Accepted keyboard-interactive/pam for jpb from fe80::2c0:4fff:fe18:13fd%ep0 port 27492 ssh2 +#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2 +#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql +#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0 +#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1 +#Oct 18 06:11:11 foohost login: login on ttyv0 as root +#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 +#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 +#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 +# + +# +# sshd Problems +# -------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) +desc=$0 +action=write - USERACT: $1 sshd $2 problem, text: $3 at %t + +# +# sshd Accepted +# -------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*) +desc=$0 +action=write - USERACT: $1 sshd accepted login, text: $2 at %t + +# +# login FAILURES +# --------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*) +desc=$0 +action=write - USERACT: $1 login $2 on $4 at %t + +# +# su bad +# ----------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) +desc=$0 +action=write - USERACT: $1 su: $2 $3 to $4 on $5 at %t + +#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 +#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 +#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 +# +# +# su good to root +# ----------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) +desc=$0 +action=write - USERACT: $1 su: $2 to ROOT on $4 at %t + + diff --git a/clamav.sec b/clamav.sec new file mode 100644 index 0000000..6ab594f --- /dev/null +++ b/clamav.sec @@ -0,0 +1,8 @@ +#Detects Clamav syslogs and reports them in a general report + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND +desc=$0 +action=add GENERAL_REPORT CLAMD: $2 on $1 + diff --git a/conf.README b/conf.README new file mode 100644 index 0000000..a25550f --- /dev/null +++ b/conf.README @@ -0,0 +1,10 @@ +This is the SEC configuration directory. Because SEC usage varies so widely +from user to user, this Fedora Extras package is configured by default to not +run. + +The commented-out default settings in /etc/sysconfig/sec will load any file in +this directory with a .sec suffix. Please look through the example files +included in /etc/sec/examples/ and install the ones you want here (taking into +account that the examples are generic and some of them may need to be tweaked +to work with your setup). You should also read the SEC man page so you have +at least a basic understanding of the SEC configuration commands. diff --git a/cvs.sec b/cvs.sec new file mode 100644 index 0000000..f0f67c4 --- /dev/null +++ b/cvs.sec @@ -0,0 +1,36 @@ + +#Jul 31 19:54:21 xxxx xinetd[2088]: START: cvspserver pid=16385 from=xx.xx.xx.xx + +type=single +desc = cvsp server connection start +ptype=regexp +pattern=([A-z._0-9-]*) xinetd\[\d+\]: START: cvspserver pid=\d+ from=(\d+\.\d+\.\d+\.\d+) +action=add GENERAL_REPORT CVS Connection from $2 on $1 + + +#Aug 5 10:38:29 xxxx cvs: password mismatch for username in /usr/local/cvsroot: PMOv/9hZsf6v. vs. PMMlzZLYrbthY + +type=single +ptype=regexp +pattern=([A-z._0-9-]*) cvs: password mismatch for (.*) in (.*) +desc = cvs login failure +action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@yourdomain.com + + +#Aug 5 10:38:49 xxxx cvs: attempt to root from account: username + +type=single +ptype=regexp +pattern=([A-z._0-9-]*) cvs: attempt to root from account: (.*) +desc = cvs login to root attempt +action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@yourdomain.com + + +#Aug 5 10:42:37 xxxx cvs: login failure (for /usr/local/cvsroot) + +type=single +ptype=regexp +pattern=([A-z._0-9-]*) cvs: login failure \(for /usr/local/cvsroot\) +desc = cvs login failure +action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@yourdomain.com + diff --git a/dameware.sec b/dameware.sec new file mode 100644 index 0000000..ad840a8 --- /dev/null +++ b/dameware.sec @@ -0,0 +1,15 @@ +#Dameware Connect +type=single +ptype=regexp +pattern=([A-z._0-9-]*) DMWRCS: (.*) Connect: (.*) +desc = Dameware Connect +action=add WINDOWS_REPORT DAMEWARE CONNECT: %s; \ +pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@yourdomain.com + + +#Dameware Disconnect +type=single +ptype=regexp +pattern=([A-z._0-9-]*) DMWRCS: (.*) Disconnect: (.*) +desc = Dameware Disconnect +action=add WINDOWS_REPORT DAMEWARE DISCONNECT: %s diff --git a/dbi-example.sec b/dbi-example.sec new file mode 100644 index 0000000..046e1c4 --- /dev/null +++ b/dbi-example.sec @@ -0,0 +1,25 @@ +# to use perl packages, like DBI, you need to start SEC with the *-intevents* flag. +# this rule gets run against the messages file to log events to a central DB. +# not so much for the rule itself, but an example using DBI: +# Submitted by Jason Chambers + +type=Single +ptype=RegExp +pattern=^(\S+\s+\S+\s+\S+)\s+(\S+)\s+(\S+:)\s+(\S+\s+\S+\s+\S+\s+)?(\S+)\s+:\s+\S+\s+;\s+(\S+)\s+;\s+(\S+)\s+;\s+(.*) +desc=update db log +action=assign %H $2;\ + assign %Z $5;\ + assign %U $6;\ + assign %R $7;\ + assign %C $8;\ + assign %N %u;\ + assign %I 0;\ + eval %I (require DBI);\ + eval %D (exit(1) unless %I;\ + $COMMAND = "%C";\ + my $DBH = DBI->connect('DBI:mysql:/DBname/:/DBhost/', '/DBuser/', '/DBpass/');\ + my $SQL = " SQL statement";\ + $DBH->do($SQL);\ + ); + + diff --git a/general.sec b/general.sec new file mode 100644 index 0000000..99856ff --- /dev/null +++ b/general.sec @@ -0,0 +1,302 @@ +# General log events, unix systems. From various sources +# +# Bad su +# ----------- +# +type=Single +ptype=RegExp +desc=$0 +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) +action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@email.com + +type=Single +ptype=RegExp +desc=$0 +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) +action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@email.com + + +# MONITOR.conf - SEC rules to pick up disruptive monitoring +# events. +# +#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) +#---------------------------------------------------------------------- +#Nov 15 20:02:48 foohost syslogd: exiting on signal 15 +#Nov 22 02:00:02 foohost syslogd: restart +#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled +#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled +# + +# +# Syslog Exit +# ----------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+) +desc=$0 +action=write - MONITOR: $1 syslog exit on signal $2 at %t + +# +# Syslog Restart +# --------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart +desc=$0 +action=write - MONITOR: $1 syslog restart at %t + +# +# Syslog Exit +# ----------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+) +desc=$0 +action=write - MONITOR: $1 $2 promiscuous mode $3 at %t + + +# +# sshd Problems +# -------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) +desc=$0 +action=write - USERACT: $1 sshd $2 problem, text: $3 at %t + +# +# sshd Accepted +# -------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*) +desc=$0 +action=write - USERACT: $1 sshd accepted login, text: $2 at %t + +# +# login FAILURES +# --------------- +# +#type=Single +#ptype=RegExp +#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*) +#desc=$0 +#action=write - USERACT: $1 login $2 on $4 at %t + + +#SSH Auth failure on bsd 5 +#type=Single +#ptype=RegExp +#pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: error: PAM: authentication error for (/S+) from (/S+) +#desc=$0 +#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' + +# +# su bad +# ----------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) +desc=$0 +action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' + +#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 +#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 +#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 +# +# +# su good to root +# ----------------- +# +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) +desc=$0 +action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +#action=write - USERACT: $1 su: $2 to ROOT on $4 at %t + +# +# Cabling Problem +# ---------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem +desc=$0 +action=event 0 $1 PHYSMOD:ORANGE cable problem on $2, text: $3 at %t + + + +# USERACT - Events concerning user activities. +# +# Sample BSD logs involving logins, change of UID and privilege escalations. +#--------------------------------------------------------------------------- +#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1 +#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100 +#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for foouser from 192.168.1.1 port 1077 ssh2 +#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2 +#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql +#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0 +#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1 +#Oct 18 06:11:11 foohost login: login on ttyv0 as root +#Nov 10 19:40:03 foohost su: foouser to root on /dev/ttyp0 +#Nov 18 09:37:38 foohost su: BAD SU foouser to root on /dev/ttyp3 +#Nov 22 12:26:44 foohost su: BAD SU goodboy to root on /dev/ttyp0 +# + +# +# sshd Problems +# -------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) +desc=$0 +action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +#action=event 0 $1 USERACT:YELLOW sshd $2 problem, text: $3 at %t + +# +# login FAILURES +# --------------- +# ORANGE +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(sshd|login): (.*?FAILURE.)(.*?ON) (.*) +desc=$0 +action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' +#action=event 0 $1 USERACT:YELLOW login $2 on $4 at %t + + +# NETWACT - SEC rules to pick up suspicious network events. +# +# Sample BSD logs involving odd or suspicious network activity. +#-------------------------------------------------------------- +#Jun 3 17:46:24 foohost named[38298]: client 10.12.127.176#3714: request has invalid signature: tsig verify failure +#Apr 14 16:23:08 foohost /kernel: arp: 10.10.152.12 moved from 00:90:27:37:35:cf to 00:d0:59:aa:61:11 on de0 +#Apr 1 11:23:39 sixshooter /kernel: Limiting closed port RST response from 368 to 200 packets per second + + +# +# named Dynamic DNS Update rejection +# ---------------------------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+named\[\d+\]: client (\S+): request has invalid signature:(.*) +desc=$0 +action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" + +# +# MAC address moved +# ----------------- +# ORANGE +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: arp: (\S+) moved from (\S+) to (\S+) on (\S+) +desc=$0 +action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" + +# +# DoS RST rate limit +# ------------------ +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Limiting closed port RST response from (\d+) to (\d+) +desc=$0 +action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" + + + +# COMPROM - SEC rules to pick up potential system compromise events. +# +# Sample BSD logs involving potential system compromise. +#------------------------------------------------------- +#May 25 18:09:55 foohost ntpd[1325]: ntpd exiting on signal 11 +#Jul 21 18:33:16 foohost /kernel: pid 55454 (ftpd), uid 1001: exited on signal 8 +#Apr 9 12:57:06 foohost /kernel: pid 28039 (telnet), uid 0: exited on signal 3 (core dumped) + +# +# ntpd crash +# ------------------ +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+ntpd\[\d+\]: ntpd exiting on signal (\d+) +desc=$0 +action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" + +# +# Process crash +# ------------------ +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pid \d+ \(\S+\), uid (\d+): exited on signal (\d+) +desc=$0 +action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" + + + +# PROCESS - SEC rules to pick up suspicious process events. +# +# Sample BSD logs involving unusual processes. +#--------------------------------------------- +#Mar 23 08:05:52 foohost thttpd[126]: thttpd/2.25b 29dec2003 starting on port 8090 + +# +# Suspicious processes +# -------------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(thttpd)\[(\d+)\]:(.*) +desc=$0 +action=pipe 'SUSPROC: $1 suspicious process $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process $2" + + + +# SHUTRST - SEC rules to pick up system shutdown, restart events. +# +# Sample BSD logs involving system shutdown and reset. +#----------------------------------------------------- +#Mar 6 16:28:13 foohost reboot: rebooted by foouser +#Jul 15 17:35:49 foohost halt: halted by root +#Mar 6 16:29:17 foohost /kernel: Copyright (c) 1992-2003 The FreeBSD Project. + +# +# Reboot message +# -------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+reboot: rebooted by (\S+) +desc=$0 +action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" + +# +# Halt message +# -------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+halt: halted by (\S+) +desc=$0 +action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" + +# +# Restart message +# -------------- +# +type=Single +ptype=RegExp +pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Copyright \(c\) (\S+) The FreeBSD Project +desc=$0 +action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" + diff --git a/hp-openview.sec b/hp-openview.sec new file mode 100644 index 0000000..17db678 --- /dev/null +++ b/hp-openview.sec @@ -0,0 +1,110 @@ +################################################################ +# Sample SEC ruleset for HP OpenView ITO +################################################################ + +# process Cisco linkDown/linkUp trap events received from +# HP OpenView ITO trap template through itostream plugin +# Submitted by Risto Vaarandi + +type=PairWithWindow +ptype=RegExp +pattern=node=(\S+).*msg_text=cisco linkdown trap on interface (\S+) +desc=CISCO $1 INTERFACE $2 DOWN +action=event %s; +continue2=TakeNext +ptype2=RegExp +pattern2=node=$1.*msg_text=cisco linkup trap on interface $2 +desc2=CISCO %1 INTERFACE %2 BOUNCE +action2=event %s; +window=20 + +type=SingleWithSuppress +continue=TakeNext +ptype=RegExp +pattern=CISCO (\S+) INTERFACE (\S+) DOWN +desc=cisco $1 interface $2 down +action=reset +1 %s +window=60 + +type=Pair +ptype=RegExp +pattern=CISCO (\S+) INTERFACE (\S+) DOWN +desc=cisco $1 interface $2 down +action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major down +ptype2=RegExp +pattern2=node=$1.*msg_text=cisco linkup trap on interface $2 +desc2=cisco %1 interface %2 up +action2=shellcmd /home/opc_op/cisco_msg.sh %1 %2 normal up +window=86400 + +type=SingleWith2Thresholds +ptype=RegExp +pattern=CISCO (\S+) INTERFACE (\S+) BOUNCE +desc=cisco $1 interface $2 is unstable +action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major unstable +window=3600 +thresh=10 +desc2=cisco $1 interface $2 is stable again +action2=shellcmd /home/opc_op/cisco_msg.sh $1 $2 normal stable +window2=10800 +thresh2=0 + +# +# the cisco_msg.sh script: +# +##!/bin/sh +# +#NODE=$1 +#IF=$2 +#SEV=$3 +#TEXT=$4 +# +## use snmpget utility from Net-SNMP package +#IFNAME=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.2.1.2.2.1.2.$IF` +#DESCR=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.4.1.9.2.2.1.1.28.$IF` +# +#MSG=`echo "Interface $IFNAME ($DESCR) $TEXT" | sed s/\"/\'/g` +# +#/opt/OV/bin/OpC/opcmsg node=$NODE app=cisco obj=if \ +# sev=$SEV msg_grp=Network msg_text="$MSG" +# + + +# process APC ups "not online" trap events received from +# HP OpenView ITO trap template through itostream plugin + +type=SingleWithScript +ptype=RegExp +pattern=node=(\S+).*msg_text=APC ups not online +script=/home/opc_op/check_apc.sh $1 +desc=APC ups is not online! +action=shellcmd /opt/OV/bin/OpC/opcmsg node=$1 app=APC obj=state \ + msg_grp=UPS sev=critical msg_text='%s' + +# +# the check_apc.sh script +# +##!/bin/sh +# +## sleep for a few seconds and check if the UPS error is still present; +## if it is, exit with 0, otherwise exit with 1 +# +#UPS=$1 +#sleep 5 +# +## use snmpget utility from Net-SNMP package +#STATUS=`/usr/bin/snmpget -c public -OQve $UPS .1.3.6.1.4.1.318.1.1.1.4.1.1.0` +# +## According to the APC Powernet MIB the variable .1.3.6.1.4.1.318.1.1.1.4.1.1 +## takes the the following values: unknown(1), onLine(2), onBattery(3), +## onSmartBoost(4), timedSleeping(5), softwareBypass(6), off(7), rebooting(8), +## switchedBypass(9), hardwareFailureBypass(10), sleepingUntilPowerReturn(11), +## and onSmartTrim(12), where onLine(2) is the normal state for the UPS +# +#if [ $STATUS -eq 2 ] +#then +# exit 1 +#else +# exit 0 +#fi +# diff --git a/labrea.sec b/labrea.sec new file mode 100644 index 0000000..040bed2 --- /dev/null +++ b/labrea.sec @@ -0,0 +1,29 @@ +#Labrea tarpit events + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Initial Connect \(tarpitting\): (\d+\.\d+\.\d+\.\d+\s\d+) \-> \d+\.\d+\.\d+\.\d+\s(.*) +desc=$0 +action=add TARPIT_REPORT %t: $1 New Tarpitted Connect from $2 on port $3 + +#type=Single +#ptype=RegExp +#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Additional Activity: (\d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ (\d+)* +#desc=$0 +#action=add TARPIT_REPORT %t: %s; +# + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Responded to a PING: (d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ +desc=$0 +action=add TARPIT_REPORT %t: PING Sweep from $@ on $3 + +#Send hourly tarpit report + +type=Calendar +time=0 8,12,20 * * * +desc=Sending tarpit report... +action=report TARPIT_REPORT \ + /usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@yourdomain.com; \ + delete TARPIT_REPORT diff --git a/mpd.sec b/mpd.sec new file mode 100644 index 0000000..cd9b476 --- /dev/null +++ b/mpd.sec @@ -0,0 +1,18 @@ + +type=single +desc = mpd connection start +ptype=regexp +pattern=([A-z._0-9-]*) mpd: PPTP connection from (\d+\.\d+\.\d+\.\d+):\d+ +action=add GENERAL_REPORT MPD Start from $2 on $1 + +type=single +ptype=regexp +pattern=([A-z._0-9-]*) mpd: Name: (.*) +desc = mpd user auth +action=add GENERAL_REPORT MPD User $2 Auth on $1 + +type=Single +ptype=RegExp +pattern=([A-z._0-9-]*) mpd: pptp\d: killing connection with (\d+\.\d+\.\d+\.\d+):\d+ +desc=mpd connection end +action=add GENERAL_REPORT MPD Connection end from $2 on $1 diff --git a/pix-security.sec b/pix-security.sec new file mode 100644 index 0000000..fa99013 --- /dev/null +++ b/pix-security.sec @@ -0,0 +1,241 @@ +#################################################################### +# SEC ruleset for Cisco PIX 6.x, 7.x +#################################################################### + +# Process various events from PIX syslog output +# +# Submitted by Chris Sawall +# email: sawall -[at]- gmail -[dot]- com +# Last Updated: 5/20/05 + +# ------------------------------------------------------------------ +# Watch for weird failures - possible trojan/worm +# ------------------------------------------------------------------ + +# Watch for 10 denies within 10 seconds. Especially useful to monitor +# for certain trojans and mass mailers +# +type=SingleWithThreshold +ptype=RegExp +pattern=\s*.*Deny\s+(\w+)\s+src.*:(.*)/.*:(.*)/(\b2\d\b).*$ +desc=Unusual Failures:$1 $4/$2 -> $3 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +window=10 +thresh=10 + +# Monitor for occurrances of certain variant of PHEL trojan destined +# for two different class C networks +# +type=Single +continue=dontcont +ptype=RegExp +pattern=(212\.147\.14[12]\.) +desc=Possible PHEL Trojan (1) +action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@domain.com; delete phel_$1 + +# ------------------------------------------------------------------ +# Watch for firewall failovers +# ------------------------------------------------------------------ + +# Firewall failures/failovers +# Works for PIX 7.x + +# Failure of secondary (standby) firewall while primary is active +# Works for PIX 7.x +# +# $1 is the IP address of the primary firewall +# +type=Single +continue=takenext +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Primary\).*$ +desc=Secondary firewall for $1 - failure/reload +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 + +# Failure of secondary (standby) firewall while primary is active +# Works for PIX 7.x +# +# $1 is the IP address of the primary firewall +# +type=Single +continue=takenext +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Secondary\).*$ +desc=Primary firewall for $1 - failure/reload +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 + +# Failure of secondary (active), primary assumes active +# Works for PIX 7.x +# +# The first "desc" and "action" don't really do anything here. But SEC requires them to be present. +# $1 is the IP address of the primary firewall +# +type=Pair +continue=dontcont +ptype=RegExp +pattern=PIX-1-102001:\s+\(Primary\).*$ +desc=$0 +action=logonly +ptype2=RegExp +pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Primary\).*Peer state Standby Ready +desc2=Secondary (was active) firewall ($1) has failed. Primary is now active. +action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +window=5 + +# Failure of primary (active), secondary assumes active +# Works for PIX 7.x +# +# The first "desc" and "action" don't really do anything here. But SEC requires them to be present. +# $1 is the IP address of the primary firewall +# +type=Pair +continue=dontcont +ptype=RegExp +pattern=PIX-1-102001:\s+\(Secondary\).*$ +desc=$0 +action=logonly +ptype2=RegExp +pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Secondary\).*Peer state Standby Ready +desc2=Primary firewall ($1) has failed. Secondary is now active. +action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +window=5 + +# ------------------------------------------------------------------ +# Watch for firewall reloads +# ------------------------------------------------------------------ + +# Manual reload of PIX +# Works for PIX 6.x +# +# $1 is the IP address of the primary firewall +# +type=Single +continue=dontcont +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX reload.*$ +desc=$1 has been manually rebooted +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com ; delete ffo_$1 + +# Manual reload of PIX +# Works for PIX 7.x +# +# $1 is the IP address of the primary firewall +# +type=Single +continue=dontcont +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Orderly reload.*Reload reason:\s(\S+) +desc=$1 has been manually rebooted, reason: $2 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 + +# ------------------------------------------------------------------ +# Watch for SSH logins/failures on firewalls +# ------------------------------------------------------------------ + +# Suppress emails concerning pixbkup account +# In this case, the pixbkup acct is used to backup the PIX firewalls +# Keeping email alerts to a minimum, this skips past these alerts +# +type=Suppress +continue=dontcont +ptype=RegExp +pattern=pixbkup + +# Successful Admin SSH session +# Works for PIX 6.x +# +# Monitor for successful SSH connections to the PIX firewall +# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr +# +type=Single +continue=dontcont +ptype=RegExp +pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'.*to\s(\d+\.\d+\.\d+\.\d+)\/0.*SSH +desc=Admin Auth to $1.$2 -> $3 from $4 +action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# Successful Admin SSH session +# Works for PIX 7.x +# +# Monitor for successful SSH connections to the PIX firewall +# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr +# +type=Single +continue=dontcont +ptype=RegExp +pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'\sfrom\s(\d+\.\d+\.\d+\.\d+)\/0.*/22.*$ +desc=Admin Auth to $1.$2 -> $3 from $4 +action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# Failed Admin SSH session +# Works for PIX 6.x +# +# Monitor for failed SSH attempts to the PIX firewalls +# $1 is the user acct +# +type=Single +continue=takenext +ptype=RegExp +pattern=Authentication failed.*\'(\S+)\'.*SSH +desc=Admin Auth FAILED -> $1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# Failed Admin SSH session +# Works for PIX 7.x +# +# Monitor for failed SSH attempts to the PIX firewalls +# $1 is the user acct +# +type=Single +continue=takenext +ptype=RegExp +pattern=Authentication failed.*\'(\S+)\'.*/22.*$ +desc=Admin Auth FAILED -> $1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# Normal SSH termination +# Works for both PIX 6.x and 7.x +# +# $1 is the IP of the firewall and $2 is the user acct +# +type=Single +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*\"(\S+)\".*terminated normally +desc=ADMIN END $1 -> $2 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# SSH session timeout or abnormal termination +# Works for PIX 6.x +# May work for PIX 7.x - not tested but PIX-6-315011 is the same for 6 and 7. +# +# $1 is the IP of the firewall +# +type=Single +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*disconnected by SSH server +desc=Firewall session END - timeout $1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# ------------------------------------------------------------------ +# Watch for firewall commands +# ------------------------------------------------------------------ + +# Admin executed "write mem" +# Works for both PIX 6.x and 7.x +# +# $1 is the IP of the firewall +type=Single +ptype=RegExp +pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*write\sm.* +desc=User wrote config to memory -> $1 +action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@domain.com; delete fwcmd_$1 + +# Watch for HIGH CPU Utilization +# Works for PIX 6.x +# +type=Single +ptype=RegExp +pattern=PIX-.-211003 +desc=HIGH CPU Utilization +action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@domain.com; delete fwcmd_$1 + diff --git a/pix-url.sec b/pix-url.sec new file mode 100644 index 0000000..306169a --- /dev/null +++ b/pix-url.sec @@ -0,0 +1,75 @@ +#################################################################### +# SEC ruleset for Monitoring Keywords +#################################################################### + +# This particular ruleset was designed to monitor PIX syslog traffic +# and watch for keywords in URL traffic. Starting SEC must include +# the -intevents option. +# +# Currently tested for PIX 6.x +# +# Submitted by Chris Sawall +# email: sawall -[at]- gmail -[dot]- com +# Last Updated: 5/20/05 + +# Wait for SEC to start up or be restarted and then read in two lists +# of words. The first being a list of words to watch for and alert on, +# the second list being a list of exclusions for a suppression rule. +# +type=Single +ptype=PerlFunc +pattern=sub { if(($_[0] eq "SEC_STARTUP") || ($_[0] eq "SEC_RESTART")) { @words=`cat /root/watch4badwords`; chomp(@words); $list=join('|', @words); @ewords=`cat /root/watch4excludes`; chomp(@ewords); $excludes=join('|', @ewords);} } +desc=$0 +context=SEC_INTERNAL_EVENT +action=write - Set word list variable; + +# ------------------------------------------------------------------ +# Scan for certain URLs +# ------------------------------------------------------------------ + +# Monitor and match on keywords from the exclusions file and +# suppress reporting on them. +# +type=Suppress +continue=dontcont +ptype=PerlFunc +pattern=sub {($_[0] =~ /($excludes)/) } + +# Monitor for keywords and send an email alert +# +type=Single +ptype=PerlFunc +pattern=sub {($_[0] =~ /($list)/) } +desc=Inappropriate word in URL +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 + +# +# Examples of "watch4badwords" and "watch4excludes" +# +# File should be a return delimited file. The +# script read the file in literally and creates +# an OR statement by putting a pipe (|) between +# all of the keywords. +# +# Be careful on what words are being monitored. +# The word virgin also finds virginia and alerts +# on it. +# +# The following are examples of things that work: +# +# ----> watch4badwords +# +# \bvirgin\b +# \byoung girl\b +# \b[Pp]layboy\b +# pr0n +# hardcore +# +# ----> watch4excludes +# +# \b10\.10\.2\.4\b +# \bcherry tree\b +# cnn.com +# + + diff --git a/portscan.sec b/portscan.sec new file mode 100644 index 0000000..85303af --- /dev/null +++ b/portscan.sec @@ -0,0 +1,40 @@ +################################################################ +# Sample SEC ruleset for "PORTSCAN FROM ip1 TO ip2:port" events +################################################################ + +# process "PORTSCAN FROM ip1 TO ip2:port" events, and if a certain +# source host has scanned the same destination port on more than +# 10 distinct destination hosts during 60 seconds, raise an alarm + +type=Single +ptype=RegExp +pattern=PORTSCAN FROM (\S+) TO \S+:(\d+) +context=!HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 +continue=TakeNext +desc=Horizontal port sweep started from source $1 to target port $2 +action=eval %o ( $portscans{"$1:$2"} = {} ); \ + create HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 60 \ + eval %o ( delete $portscans{"$1:$2"} ) + +type=Single +ptype=RegExp +pattern=PORTSCAN FROM (\S+) TO (\S+):(\d+) +context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 +continue=TakeNext +desc=Scanned destination IP: $2 +action=eval %o ( $portscans{"$1:$3"}->{$2} = 1 ); \ + add HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 %t: %s;\ + set HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 60 \ + eval %o ( delete $portscans{"$1:$3"} ) + +type=Single +ptype=RegExp +pattern=PORTSCAN FROM (\S+) TO (\S+):(\d+) +context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ + && =( scalar(keys(%{$portscans{"$1:$3"}})) > 10 ) +continue=DontCont +desc=$1 has scanned more than 10 destinations +action=report HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ + mail -s 'Horizontal port sweep from $1 target port $3' root@localhost; \ + delete HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3; \ + eval %o ( delete $portscans{"$1:$3"} ) diff --git a/sec.init b/sec.init new file mode 100755 index 0000000..7c06c9e --- /dev/null +++ b/sec.init @@ -0,0 +1,88 @@ +#!/bin/bash +# +# sec This starts and stops SEC +# +# chkconfig: - 26 74 +# description: Simple Event Correlator script to filter log file entries +# processname: /usr/bin/sec +# config: /etc/sysconfig/sec +# pidfile: /var/run/sec.pid +# + +# Source function library. + . /etc/rc.d/init.d/functions + +# Default to a clean return value + RETVAL=0 + +# Program we'll be executing + EXEC='/usr/bin/sec' + prog='sec' + + [ -f $EXEC ] || exit 0 + +# Source the config + [ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog + +# No options defined means that sec can't run + [ -z "$SEC_ARGS" ] && exit 0 + +# And away we go... + +start() { + for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do + echo -n $"Starting $prog instance "$(($n + 1))": " + daemon $EXEC ${SEC_ARGS[$n]} + RETVAL=$? + [ $RETVAL -ne 0 ] && return $RETVAL + done + touch /var/lock/subsys/$prog + return $RETVAL +} + +stop() { + echo -n $"Stopping $prog: " + killproc $prog + RETVAL=$? + echo + [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog + return $RETVAL +} + +reload() { + echo -n $"Reloading configuration: " + killproc $prog -HUP + RETVAL=$? + echo + return $RETVAL +} + +restart() { + stop + start +} + +dump() { + echo -n $"Dumping state in /tmp/sec.dump: " + killproc $prog -USR1 + RETVAL=$? + echo + return $RETVAL +} + +sec_status() { + status $prog +} + +case "$1" in + start|stop|reload|restart|dump) + $1 + ;; + status) + sec_status + ;; + *) + echo $"Usage: $0 {start|stop|reload|restart|dump|status}" + exit 2 +esac + diff --git a/sec.logrotate b/sec.logrotate new file mode 100644 index 0000000..d536a75 --- /dev/null +++ b/sec.logrotate @@ -0,0 +1,8 @@ +/var/log/sec { + missingok + notifempty + sharedscripts + postrotate + /sbin/service sec reload 2> /dev/null > /dev/null || true + endscript +} diff --git a/sec.spec b/sec.spec new file mode 100644 index 0000000..f531410 --- /dev/null +++ b/sec.spec @@ -0,0 +1,235 @@ +# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345 +# +# Specfile for SEC, the simple event correlator +# + +Name: sec +Version: 2.3.3 +Release: 4%{?dist} +Summary: SEC (simple event correlator) + +Group: System Environment/Daemons +License: GPL +URL: http://www.estpak.ee/~risto/sec/ + +################################################################################ + +Source0: http://dl.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz +Source1: sec.sysconfig +Source2: sec.init +Source3: sec.logrotate + +# Example files and configuration info +Source100: conf.README +Source101: http://www.estpak.ee/~risto/sec/examples/syslog-ng.txt +Source102: 001_init.sec +Source103: http://www.bleedingsnort.com/sec/amavisd.sec +Source104: http://www.bleedingsnort.com/sec/bsd-MONITOR.sec +Source105: http://www.bleedingsnort.com/sec/bsd-PHYSMOD.sec +Source106: http://www.bleedingsnort.com/sec/bsd-USERACT.sec +Source107: http://www.bleedingsnort.com/sec/clamav.sec +Source108: http://www.bleedingsnort.com/sec/cvs.sec +Source109: http://www.bleedingsnort.com/sec/dameware.sec +Source110: http://www.bleedingsnort.com/sec/dbi-example.sec +Source111: http://www.bleedingsnort.com/sec/general.sec +Source112: http://www.bleedingsnort.com/sec/hp-openview.sec +Source113: http://www.bleedingsnort.com/sec/labrea.sec +Source114: http://www.bleedingsnort.com/sec/mpd.sec +Source115: http://www.bleedingsnort.com/sec/pix-security.sec +Source116: http://www.bleedingsnort.com/sec/pix-url.sec +Source117: http://www.bleedingsnort.com/sec/portscan.sec +Source118: http://www.bleedingsnort.com/sec/snort.sec +Source119: http://www.bleedingsnort.com/sec/snortsam.sec +Source120: http://www.bleedingsnort.com/sec/ssh-brute.sec +Source121: http://www.bleedingsnort.com/sec/ssh.sec +Source122: http://www.bleedingsnort.com/sec/vtund.sec +Source123: http://www.bleedingsnort.com/sec/windows.sec + +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) + +BuildArch: noarch + +################################################################################ + +Requires(post): chkconfig +Requires(postun): initscripts +Requires(preun): initscripts, chkconfig + +# The init script uses arrays, so we need bash +Requires: bash + +# Not required specifically by SEC, but our examples use it so we might as well +# create a requirement for logrotate. +Requires: logrotate + +# Some alternate names for the package that users might search for +Provides: simple-evcorr +Provides: sec.pl + +################################################################################ + +%description +SEC is an open source and platform independent event correlation tool that +was designed to fill the gap between commercial event correlation systems and +homegrown solutions that usually comprise a few simple shell scripts. +SEC accepts input from regular files, named pipes, and standard input, and can +thus be employed as an event correlator for any application that is able to +write its output events to a file stream. + +################################################################################ + +%prep +%setup -q + +# Install some handy tools + mkdir tools/ + mv itostream.c \ + convert.pl \ + tools/ + +# Replace some tags in the config files + sed -i -e 's/@@NAME@@/%{name}/' \ + %{SOURCE1} \ + %{SOURCE2} \ + %{SOURCE3} + +# Fix the bindir in case a user wants it put in a different location + sed -i -e 's#/usr/bin/sec#%{_bindir}/sec#' \ + %{SOURCE2} + +################################################################################ + +%install + +rm -rf $RPM_BUILD_ROOT + +# Create the directories we'll need + install -d -m 755 $RPM_BUILD_ROOT%{_initrddir} + install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/log + install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/run + install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d + install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig + install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples + +# Install SEC and its associated files + install -D -p -m 755 sec.pl $RPM_BUILD_ROOT%{_bindir}/sec + install -D -p -m 644 sec.pl.man $RPM_BUILD_ROOT%{_mandir}/man1/sec.1 + install -p -m 644 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/sec + install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/sec + install -p -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_initrddir}/sec + +# Install the example config files and readme + install -p -m 644 %{SOURCE100} \ + $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/README + install -p -m 644 %{SOURCE101} \ + $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/syslog-ng.sec + install -p -m 644 %{SOURCE102} \ + %{SOURCE103} \ + %{SOURCE104} \ + %{SOURCE105} \ + %{SOURCE106} \ + %{SOURCE107} \ + %{SOURCE108} \ + %{SOURCE109} \ + %{SOURCE110} \ + %{SOURCE111} \ + %{SOURCE112} \ + %{SOURCE113} \ + %{SOURCE114} \ + %{SOURCE115} \ + %{SOURCE116} \ + %{SOURCE117} \ + %{SOURCE118} \ + %{SOURCE119} \ + %{SOURCE120} \ + %{SOURCE121} \ + %{SOURCE122} \ + %{SOURCE123} \ + $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/ + +# Replace all "email.com" in sample scripts with an actual fake domain: example.com + grep -rl 'email.com' $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/ \ + | xargs sed -i -e 's/email.com/example.com/g' + +# Create ghost files so rpm doesn't complain about them being gone + touch $RPM_BUILD_ROOT%{_localstatedir}/log/sec + touch $RPM_BUILD_ROOT%{_localstatedir}/run/sec.pid + +################################################################################ + +%post + +if [ $1 = 1 ]; then + /sbin/chkconfig --add sec +fi + +%preun + +if [ $1 = 0 ]; then + /sbin/service sec stop > /dev/null 2>&1 || : + /sbin/chkconfig --del sec +fi + +%postun + +if [ $1 = 1 ]; then + /sbin/service sec condrestart +fi + +%clean + +rm -rf $RPM_BUILD_ROOT + +################################################################################ + +%files + +%defattr(-,root,root,-) +%doc ChangeLog COPYING README tools/ +%config(noreplace) %{_sysconfdir}/sysconfig/sec +%config(noreplace) %verify (not md5 size mtime) %{_sysconfdir}/logrotate.d/sec +%{_sysconfdir}/%{name} +%{_bindir}/sec +%{_initrddir}/sec +%{_mandir}/man1/* +%ghost %verify (not md5 size mtime) %{_localstatedir}/log/sec +%ghost %verify (not md5 size mtime) %{_localstatedir}/run/sec.pid + +################################################################################ + +%changelog + +* Mon Jun 12 2006 Chris Petersen 2.3.3-4 +- Change group to keep rpmlint happy +- Fix permissions on the logrotate script + +* Thu Jun 08 2006 Chris Petersen 2.3.3-3 +- Clean up spec +- Add ghost file entries for the default logfile and pid +- Add logrotate script +- Add more bleedingsnort examples +- Add pid to sec.sysconfig and completely rewrite to handle multiple instances +- Fix download URL +- Fix echo log command in 001_init.sec +- Rewrite sysV init script to handle multiple instances (based loosely on vsftpd) + +* Mon May 01 2006 Didier Moens 2.3.3-2 +- Change init script to not start by default in any runlevel + +* Fri Apr 28 2006 Didier Moens 2.3.3-1 +- Upgrade to upstream 2.3.3 +- Add status to init script + +* Thu Sep 22 2005 Didier Moens 2.3.2-4 +- Update Source locations + +* Thu Sep 22 2005 Didier Moens 2.3.2-3 +- Change permissions on /usr/bin/sec + +* Thu Sep 22 2005 Didier Moens 2.3.2-2 +- Create initial startup rulesets +- Add examples +- Refine init script + +* Wed Sep 21 2005 Didier Moens 2.3.2-1 +- First build diff --git a/sec.sysconfig b/sec.sysconfig new file mode 100644 index 0000000..db96875 --- /dev/null +++ b/sec.sysconfig @@ -0,0 +1,25 @@ +# +# Because SEC usage varies so widely from user to user, it is configured by +# default to not run. Please read `sec --help` for valid options to use in +# this configuration directive, or use the sample defaults included below. +# +# If you would like to run multiple instances of sec in order to track more +# than one log file, you can use also use $SEC_OPTIONS as an array. +# +# Also, please don't forget to read the sec man page or look at the +# configuration options for /etc/sec/. +# + +# +# Default: +# +# SEC_ARGS="-detach -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.pid" +# + +# +# For Multiple instances of SEC, use something like: +# +# SEC_ARGS[0]="-detach -conf=/etc/sec/sys/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.sys.pid" +# +# SEC_ARGS[1]="-detach -conf=/etc/sec/mail/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.mail.pid" +# diff --git a/snort.sec b/snort.sec new file mode 100644 index 0000000..17e60d6 --- /dev/null +++ b/snort.sec @@ -0,0 +1,157 @@ +#################################################################### +# Sample SEC ruleset for Snort IDS +#################################################################### + +# ------------------------------------------------------------------ +# Handle portscans +# ------------------------------------------------------------------ + +# For every completed portscan, add an entry to the PORTSCAN_REPORT; +# also generate a meta-event ACTIVITY_FROM for the IP + +type=Single +ptype=RegExp +pattern=End of portscan from (([\d\.]+).*) +desc=Portscan from $1 +action=add PORTSCAN_REPORT %t: %s; event ACTIVITY_FROM_$2: %s + + +# ------------------------------------------------------------------ +# Recognize snort alert message and generate corresponding SEC event +# ------------------------------------------------------------------ + +# recognize snort alert message; also generate +# a meta-event ACTIVITY_FROM for the IP + +type=Single +ptype=RegExp +pattern=snort(?:\[\d+\])?: \[[0-9:]+\] (.+|!Malware|!MALWARE) \[(.+)\] \[.*Priority: (\d+)\]: \S+ ([\d\.]+):?\d* -> ([\d\.]+):?\d* +desc=PRIORITY $3 INCIDENT FROM $4 TO $5: $1 [$2] +action=event %s; event ACTIVITY_FROM_$4: $1 + + +## Detect if it's an unwanted event in snort +#type=Single +#ptype=RegExp +#pattern=(MALWARE|Malware) +#desc=$0 +#action=create UNWANTED_EVENT + + +# ------------------------------------------------------------------ +# Handle priority 1 incidents +# ------------------------------------------------------------------ + +# Detect the beginning of priority 1 attack from a certain source IP, +# and send a warning e-mail message that a new attack has begun; +# also create a context for storing a detailed information about the attack + +type=Single +ptype=RegExp +pattern=PRIORITY 1 INCIDENT FROM (\S+) TO \S+: .+ +context=ATTACK_FROM_$1 +continue=TakeNext +desc=Priority 1 attack started from $1 +action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' + + +# For every priority 1 incident, add an entry to the context by its IP; +# if the IP has been quiet for 5 minutes, report the whole attack + +type=Single +ptype=RegExp +pattern=PRIORITY 1 INCIDENT FROM (\S+) TO (\S+): (.+) +context=ATTACK_FROM_$1 +continue=TakeNext +desc=Priority 1 incident from $1 to $2: $3 +action=add ATTACK_FROM_$1 %t: %s; \ + set ATTACK_FROM_$1 300 ( report ATTACK_FROM_$1 \ + /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@email.com ) + + +# ------------------------------------------------------------------ +# Handle incidents by thresholding +# ------------------------------------------------------------------ + +# Count how many _certain type_ of incidents are coming from one source +# if the threshold has been crossed, reset the counting operation started +# by the next rule, in order to avoid duplicate alerts for the same IP + +type=SingleWithThreshold +ptype=RegExp +pattern=PRIORITY (\d+) INCIDENT FROM (\S+) TO \S+: (.+) +continue=TakeNext +desc=Snort has seen >= 30 priority $1 incidents from $2: $3 +action=add ALERT_REPORT %t: %s; \ + reset +1 Snort has seen >= 150 incidents from $2; \ + create TURNOFF_$2 3600 +thresh=30 +window=3600 + + +# Count how many incidents come from one source + +type=SingleWithThreshold +ptype=RegExp +pattern=PRIORITY \d+ INCIDENT FROM (\S+) TO \S+: .+ +context=!TURNOFF_$1 +desc=Snort has seen >= 150 incidents from $1 +action=add ALERT_REPORT %t: %s +thresh=150 +window=7200 + + +# ------------------------------------------------------------------ +# Report IPs that have been active for some time +# ------------------------------------------------------------------ + +# Set up activity contexts for the IP; if the IP has been active for 2 hours, +# and there have been no gaps longer than 30 minutes, report its activities + +type=Single +ptype=RegExp +pattern=ACTIVITY_FROM_(\S+): +context=!ACTIVITY_LIST_FOR_$1 +continue=TakeNext +desc=Create activity contexts for $1 +action=create ACTIVITY_LIST_FOR_$1_LIFETIME; \ + create ACTIVITY_LIST_FOR_$1 7200 ( report ACTIVITY_LIST_FOR_$1 \ + /usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@email.com; \ + delete ACTIVITY_LIST_FOR_$1_LIFETIME ) + + +# Add the activity event to the context of a given IP, and extend +# the lifetime of activity contexts for 30 minutes for the IP + +type=Single +ptype=RegExp +pattern=ACTIVITY_FROM_(\S+): (.*) +context=ACTIVITY_LIST_FOR_$1 +desc=Activity from $1: $2 +action=add ACTIVITY_LIST_FOR_$1 %t: %s; \ + set ACTIVITY_LIST_FOR_$1_LIFETIME 1800 ( delete ACTIVITY_LIST_FOR_$1 ) + + +# ------------------------------------------------------------------ +# Send reports every day at 9:00 am +# ------------------------------------------------------------------ + +# send daily report about regular alerts + +type=Calendar +time=0 12 * * * +desc=Sending alert report... +action=report ALERT_REPORT \ + /usr/bin/mail -s 'SNORT: Hourly alert report' alerts@email.com; \ + delete ALERT_REPORT + + +# send daily report about portscans + +type=Calendar +time=0 9 * * * +desc=Sending portscan report... +action=report PORTSCAN_REPORT \ + /usr/bin/mail -s 'SNORT: daily portscan report' alerts@email.com; \ + delete PORTSCAN_REPORT + diff --git a/snortsam.sec b/snortsam.sec new file mode 100644 index 0000000..b0a687c --- /dev/null +++ b/snortsam.sec @@ -0,0 +1,70 @@ + + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Error: Could not bind socket. +desc = $0 +action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@yourdomain.com + + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*), email, Error: \[email\] Did not receive a response waiting for banner on mail server at (.*) +desc = $0 +action=add SNORTSAM_REPORT $1 Couldn't email through $3 : %s + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) snortsam, Extending block for host ([A-z._0-9-]*) completely for (.*) +desc = $0 +action=add SNORTSAM_REPORT $1 Extending Block for $3 for $4 + + +#type=single +#ptype=regexp +#pattern=([A-Za-z0-9._-]+)snortsam\[([0-9]+)\]: [*], [:0-9]+, -, ipf, (.*) Failed +#desc = Snortsam ipf error +#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@yourdomain.com +##action=add SNORTSAM_REPORT ERROR $1 IPF Command Failure: $2 + + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Starting to listen for Snort alerts. +desc = $0 +action=add SNORTSAM_REPORT $1 Snortsam Startup: %s + + +#type=single +#ptype=regexp +#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Removing (.*) complete block for host (.*). +#desc = $0 +#action=add SNORTSAM_REPORT $1 Snortsam Removing Block: %s + +#type=single +#ptype=regexp +#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Blocking host (.*) completely for (.*) \((Sig_ID: \d+\))\. +#desc = $0 +#action=add SNORTSAM_REPORT $1 Snortsam Block: %s + + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*) ipf, Error: Command (.*) Failed +desc = $0 +action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@yourdomain.com + +type=single +ptype=regexp +pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Snortsam Station .* using wrong password, trying to resync. +desc = $0 +action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@yourdomain.com + +#Send hourly snortsam report + +type=Calendar +time=0 * * * * +desc=Sending snortsam report... +action=report SNORTSAM_REPORT \ + /usr/bin/mail -s 'SNORTSAM report' alerts@yourdomain.com; \ + delete SNORTSAM_REPORT diff --git a/sources b/sources index e69de29..8fabc54 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +1b714a7dbb71e165327886a329f6d1e0 sec-2.3.3.tar.gz diff --git a/ssh-brute.sec b/ssh-brute.sec new file mode 100644 index 0000000..884eec9 --- /dev/null +++ b/ssh-brute.sec @@ -0,0 +1,67 @@ +################## ssh brute force attack blocker +# This sec ruleset monitors syslog messages for indications that an ssh brute-force +# login attack is underway. The trigger is an ssh login failure. +# +# If 4 additional syslog messages about ssh login failures from the same +# source address are received within next 1 minute, an iptables firewall +# rule is added to block access from the source IP. +# +# After that, the correlation operation waits until no ssh login failure +# syslog messages from the source IP have been received from the router +# during the last 2 hours, and then the iptables rule is removed. By +# definition, once the IP is blocked, there will be no more connection +# attempt failures logged by ssh (ie., packets will be dropped by the kernel +# before they reach the syslog daemon), so the rule will be flushed after +# 2 hours. +# +# Vulnerabilities of this ruleset are: +# DoS attack: if the attacker is aware of this ruleset, they could +# spoof a series of victim IP addresses (for example, the +# AOL proxy address), thus causing the server running sec +# to deny service to the victim. +# +# persistent firewall rules: +# if the sec daemon crashes or is restarted, any existing rules +# will not be removed after 2hours +# +# window=60 # sliding window (1 minute) for initial event match +# thresh=4 # number of events (ssh login failures from a given IP) that must +# # occur within the window period in order to trigger the action +# +# window2=7200 # sliding window (2 hours) for the second event match +# thresh2=0 +############### +# RCSversion="$Header: /home/fedora/jkeating/pkgs/rpms/sec/EL-6/ssh-brute.sec,v 1.1 2006/09/01 20:54:01 xris Exp $" +# +# Representative log file entries: +# Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp +# Aug 28 04:43:03 host sshd[22568]: Failed password for illegal user library from 210.230.187.218 port 55019 ssh2 +# Aug 28 04:42:28 www.somehost.net sshd[9395]: Failed password for illegal user mysql from 210.230.187.218 port 52857 ssh2 +# Aug 28 04:42:28 host sshd[22509]: Failed password for root from 210.230.187.218 port 52960 ssh2 +# Aug 28 04:42:32 www.somehost.net sshd[9397]: Failed password for illegal user oracle from 210.230.187.218 port 53212 ssh2 +# Aug 28 04:42:32 host sshd[22510]: Failed password for illegal user admin from 2 10.230.187.218 port 53243 ssh2 + +# +type=SingleWith2Thresholds +ptype=RegExp +pattern=sshd.*: authentication failure[ ;].* rhost=(\S+) +desc=Multiple failed ssh authentication attempts from $1 +action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP ) +window=60 +thresh=4 +desc2=Pruning iptables firewall rule blocking ssh from $1 +action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ) +window2=7200 +thresh2=0 + +type=SingleWith2Thresholds +ptype=RegExp +pattern=sshd.*: Failed password for.* user .* from (\S+) +desc=Multiple ssh password failures from $1 +action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP ) +window=60 +thresh=4 +desc2=Pruning iptables firewall rule blocking ssh from $1 +action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; sleep 2; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ; sleep 2) +window2=7200 +thresh2=0 diff --git a/ssh.sec b/ssh.sec new file mode 100644 index 0000000..b718248 --- /dev/null +++ b/ssh.sec @@ -0,0 +1,253 @@ +# a ruleset to accumulate errors from a parent and child sshd process +# into a single context. This allows reporting of the authenticated +# user information with the error's generated by the child sshd process. + +# note handling of deferred reporting until after tie events received +# is still in flux. My old rules hanlded it by resubmitting all the +# events, but it didn't handle the parent defered reporting +# events. This way is cleaner, but not tested very well. + +type=single +continue=dontcont +ptype=Nregexp +pattern=sshd|SSHD +desc=filter out non-sshd events +action=none + +type=single +continue=dontcont +ptype=TValue +pattern=TRUE +desc=guard for already handled +action=logonly +context = [EVENT_PROCESSED] + +type=single +continue=takenext +ptype=TValue +pattern=TRUE +desc=We will handle. +action=create EVENT_PROCESSED + +## Recognize the start of an ssh session +# link parent and child event contexts. +# +#type=PairWithWindow +#continue=takenext +#desc=Recognize ssh session start for $1[$2] +#ptype=regexp +#pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Connection from ([0-9.]+) port [0-9]+ +#action=pipe session_log_$1_$2 \ +# /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@email.com +#desc2=Link parent and child contexts +#ptype2=regexp +#pattern2=$1 [A-z0-9]+\[[0-9]+\]: \[[^]]+\] SSHD child process +([0-9]+) spawned by $2 +#action2=copy session_log_%1_$1 %b; \ +# delete session_log_%1_$1; \ +# alias session_log_%1_%2 session_log_%1_$1; \ +# add session_log_%1_$1 $0; \ +# event 0 "sshd: Report %1_$1 if needed"; \ +# alias session_log_owner_%1_%2 session_log_owner_%1_$1 ;\ +# create tie_event_received_%1_%2 ;\ +# alias tie_event_received_%1_%2 tie_event_received_%1_$1 ;\ +# delete ssh_tie_event_needed_%1 +#window=60 + +## recognize login event and save username for later use +type=single +desc=Start login timer +ptype=regexp +pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Accepted (publickey|password) for ([A-z0-9_-]+) from [0-9.]+ port [0-9]+ (.*) +action=add session_log_$1_$2 $0; add session_log_owner_$1_$2 $4 + +# handle logout +type=single +desc=Recognize ssh session end +ptype=regexp +pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Closing connection to ([0-9.]+) +action= delete session_log_$1_$2; delete session_log_owner_$1_$2; \ + delete tie_event_received_$1_$2 + +## ignore ssh IPV6 errors. +# +# Example input: +# Nov 3 06:34:25 corphost sshd[5961]: [ID 800047 auth.error] error: \ +# connect_to ::1 port 5910: Network is unreachable +# +type=suppress +desc = ignore IPV6 errors from ssh +ptype=regexp +pattern=sshd\[[0-9]+\]: \[ID 800047 auth.error\] error: connect_to ::1 port [0-9]+: Network is unreachable + +# because the tie command can come after critical errors are reported, +# we provide a way to generate a report on demand. +type=single +desc=Report immediate on request. +ptype=regexp +pattern=^sshd: Report (.*) if needed$ +context = session_log_report_$1 +action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@email.com ;\ + delete session_log_report_$1 + +type=suppress +desc=Discard report immediate event on request. +ptype=regexp +pattern=^sshd: Report (.*) if needed$ + +# INSERT IMMEDIATE REPORT RULES HERE +# rules that should report problems immediately should go here. +# e.g. channel_setup_fwd_listener: cannot listen to port: 1521 +# where port is < 1024, or is some other well known port indicating +# possible hacking. +# +# We have five possible cases: +# Event is from parent process and no info from child process is needed. +# Report normally. +# Event is from parent process and info from child process is needed, +# and tie event received (context tie_event_received__ +# exists). Report normally. +# Event is from parent process and info from child process is needed, +# but tie event not received (context tie_event_received__ +# does not exist). +# Report using child event as trigger. +# Event that has to be reported is from the child process and +# we have received the tie event (context +# tie_event_received__ exists). Just report normally. +# Event that has to be reported is from the child process and +# we haven't received the tie event (context +# tie_event_received__ does not exist). Defer reporting +# until after tie event by setting context +# session_log_report__. +# +# We may need two rules for each event if the event can come before the tie +# event. One rule checks to see if the context ssh_tie_event_needed_$1 +# where $1 is the reporting host. If so then it needs to set the context +# session_log_report__ if generated by the child process. + +# Note we get a less specific report this way. It should be retooled +# to generate a context that the report rule can simply obsolete. +# These events are generated by the child. +type=single +continue=takenext +desc = record ssh channel_setup_fwd_listener error for $1 port < 1025 +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*) +context = $3 < 1025 && ! tie_event_received_$1_$2 +action = add session_log_$1_$2 $0 ; \ + create session_log_report_$1_$2 + +type=single +continue=takenext +desc = record ssh channel_setup_fwd_listener error for $1 port < 1025 +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*) +context = $3 < 1025 && tie_event_received_$1_$2 +action = add session_log_$1_$2 $0 ; \ + report session_log_report_$1_$2 \ + /usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@email.com + +# end immediate rules here + +## report/record ssh bind errors. +# Record ssh bind errors in the session log. Don't report unless +# we have more than 5 of them in a 10 minute period. Then go and +# find out why they are occurring. Probably a frustrated user +# getting the -L options wrong. +# +# We record all events until a 10 minute period has passed with no +# events. If the threshold is exceeded, then we report all events +# recorded during the 10 minute rolling window. +# +# We also group channel_setup_fwd_listener with this. +# +# Example input: +# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: bind: \ +# Address already in use +# +type=single +continue=takenext +desc = record ssh bind error for $1 +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use +action = add session_log_$1_$2 $0 ; \ + set ssh_port_forward_errors_$1_$2 600 + +type=singlewiththreshold +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use +context = ssh_port_forward_errors_$1_$2 +desc = send report on ssh forward errors if pass threshold (bind) +action = report session_log_$1_$2 \ + /usr/bin/mailx -s "ssh port forward errors host $1" alerts@email.com; \ + delete ssh_port_forward_errors_$1_$2 +thresh=5 +window=600 + +# Similar idea to ssh bind errors except on +# channel_setup_fwd_listener errors. If we have more than 5 +# of them in a 10 minute period, go and find out why they are occurring. +# Probably a frustrated user getting the -L options wrong. +# +# We record all events until a 10 minute period has passed with no +# events. If the threshold is exceeded, then we report all events +# recorded during the 10 minute rolling window. +# +# Example input: +# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: \ +# channel_setup_fwd_listener: cannot listen to port: 1521 +# + +type=single +continue=takenext +desc = record ssh channel_setup_fwd_listener error for $1 +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: +action = add session_log_$1_$2 $0 ; \ + set ssh_channel_setup_errors_$1_$2 600 + +type=singlewiththreshold +ptype=regexp +pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: +context = ssh_channel_setup_errors_$1_$2 +desc = send report on ssh channel setup errors +action = report session_log_$1_$2 \ + /usr/bin/mailx -s "ssh port forward errors host $1" alerts@email.com ; \ + delete ssh_channel_setup_errors_$1_$2 +thresh=5 +window=600 + +# Gather random sshd errors and report after 5 minutes +# +# This could have been set up a number of different ways, but I have one +# rule to create the context only when it doesn't exist, and another rule +# that adds to the context. The create rule also sets the 5 minute timeout +# that will cause the event store to be delivered when it is deleted. +# +# Example input: +# Nov 3 09:48:56 example sshd[7871]: [ID 800047 auth.crit] fatal: \ +# Timeout before authentication for 37.117.12.201 +# +type=single +continue = takenext +ptype=regexp +pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: +desc = create context to report ssh errors for host $1 pid $2 in 5 minutes +context = ! session_log_5min_timer_$1_$2 +action = create session_log_5min_timer_$1_$2 300 report session_log_$1_$2 \ + /usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@email.com + +type=single +continue = dontcont +ptype=regexp +pattern=([A-Za-z0-9._-]*) sshd\[([0-9]+)\]: +desc = gather ssh errors for host $1 +action = add session_log_$1_$2 $0 + +# Remove the handled context if we reach this point. +type=single +continue=dontcont +ptype=TValue +pattern=TRUE +desc=delete EVENT_PROCESSED +action=delete EVENT_PROCESSED + diff --git a/syslog-ng.txt b/syslog-ng.txt new file mode 100644 index 0000000..8bc90fc --- /dev/null +++ b/syslog-ng.txt @@ -0,0 +1,95 @@ +################################################################ +# SEC ruleset for syslog-ng (contributed by Peter Straka) +################################################################ +#date host proces[pid]: [ID number facility.level] txt + +################################################################ +# internal +################################################################ +# setings parameters for next use +# +# %A,%B,%C,%D = parameters +# %F = output file for write +# %E = email list +# %M = mail program +################################################################ + +#rule beno#1 +type=Single +ptype=RegExp +pattern=(SEC_STARTUP|SEC_RESTART|SEC_SHUTDOWN) +context=SEC_INTERNAL_EVENT +desc=SEC internal +action=shellcmd /bin/echo -- %t %s $0;\ + assign %F /tmp/sec.out;\ + assign %E root@localhost;\ + assign %M /bin/mail -s "SEC production event";\ + add OUT %t "starting";\ + +################################################################ +# statistics +################################################################ + +#rule beno#2 +type=Single +continue=TakeNext +ptype=RegExp +pattern=\s(\S+)\s(\S+)\[\d+\]\:\s\[ID \d+ (\S+)\.(\S+)\]\s +desc=log level and facility counter + host and proces counter +action= assign %A $1;\ + assign %B $2;\ + assign %C $3;\ + assign %D $4;\ + eval %Z ($host{"%A"}++; $proces{"%B"}++; $facility{"%C"}++; $level{"%D"}++;); + +#rule beno#3 +#write statistics and null counters every hour +type=Calendar +time=0 * * * * +desc=log level and facility counter + host and proces counter +action=eval %Z (\ + my @ret; \ + push(@ret,"*******************************\n***** LEVEL:\n");\ + foreach $x (keys %level) {push(@ret,sprintf "%%s=%d\n",$x,$level{$x}) if $level{$x}; $level{$x}=0}; \ + push(@ret,"\n***** FACILITY:\n");\ + foreach $x (keys %facility) {push(@ret,sprintf "%%s=%d\n",$x,$facility{$x}) if $facility{$x}; $facility{$x}=0}; \ + push(@ret,"\n***** HOSTS:\n");\ + foreach $x (keys %host) {push(@ret,sprintf "%%s=%d\n",$x,$host{$x}) if $host{$x}; $host{$x}=0}; \ + push(@ret,"\n***** PROCES:\n");\ + foreach $x (keys %proces) {push(@ret,sprintf "%%s=%d\n",$x,$proces{$x}) if $proces{$x}; $proces{$x}=0}; \ +push(@ret,"\n********************************************************\n");\ + return "@ret"); \ + write %F %t %Z; \ + add STAT %Z; \ + report STAT %M %E; \ + delete STAT ; + +################################################################ +# hourly statistics +################################################################ + +#rule beno#4 +type=Single +continue=TakeNext +ptype=RegExp +pattern=\S+\s+\d+\s+(\d+)\:\d+\:\d+\s +desc=hourly counter +action=assign %A H$1;\ + eval %Z ($hour{%A}++;); + +#rule beno#5 +#write statistics and null counters at midnight +type=Calendar +time=25 16 * * * +desc=hourly counter +action=eval %Z (\ + my @ret; \ + push(@ret,"*******************************\n");\ + foreach $x (keys %hour) {push(@ret,sprintf "%%s:00=%d\n",$x,$hour{$x});$hour{$x}=0}; \ +push(@ret,"\n********************************************************\n");\ + return "@ret"); \ + write %F %t %Z; \ + add HOUR_STAT %Z; \ + report HOUR_STAT %M %E; \ + delete HOUR_STAT + diff --git a/vtund.sec b/vtund.sec new file mode 100644 index 0000000..3eb7ef0 --- /dev/null +++ b/vtund.sec @@ -0,0 +1,71 @@ +#VTUN Events + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (\S+)\[\S\] opened +desc=$0 +action=add GENERAL_REPORT %t: %s; + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: BlowFish encryption initialized +desc=$0 +action=add GENERAL_REPORT %t: VTUN Tunnel Opened on $1 + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: VTun client ver\s+(.*) +desc=$0 +action=add GENERAL_REPORT %t: VTUN Server Started on $1 version $2 + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connecting to (.*) +desc=$0 +action=add GENERAL_REPORT VTUN %s + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Denied connection from (\d+\.\d+\.\d+\.\d+):\d+ +desc=$0 +action=add GENERAL_REPORT %t: VTUN Connection DENIED by $1 from $2 + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connection denied by (.*) +desc=$0 +action=add GENERAL_REPORT %t: VTUN Connection DENIED by $2 for $1 + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Exit +desc=$0 +action=add GENERAL_REPORT %t: VTUN Exit on $1 + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Can't resolv server address: (.*) +desc=$0 +action=add GENERAL_REPORT %t: VTUN Cannot Resolve Target $2 on $1 + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (/S+) closed +desc=$0 +action=add GENERAL_REPORT %t: VTUN Session $2 Closed on $1 + + + +#Send 12 hours vtun report + +type=Calendar +time=0 0,12 * * * +desc=Sending vtun report... +action=report VTUN_REPORT \ + /usr/bin/mail -s 'VTUN: VTUN Report' alerts@yourdomain.com; \ + delete VTUN_REPORT0 + diff --git a/windows.sec b/windows.sec new file mode 100644 index 0000000..34110e8 --- /dev/null +++ b/windows.sec @@ -0,0 +1,37 @@ +#Windows events + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+ESE: N/A: Information Store \(\d+\) Online defragmentation (.*) +desc=$0 +action=add GENERAL_REPORT EXCHANGE DEFRAG%t: %s; + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Userenv: NT AUTHORITY\\SYSTEM: Windows cannot determine the user or computer name\. Return value \(1326\). +desc=$0 +action=add GENERAL_REPORT %t: %s + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Locked Out: Target Account Name: (\S+) .* +desc=$0 +action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@yourdomain.com + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Changed: (/S+)\. .* +desc=$0 +action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@yourdomain.com + + +type=Single +ptype=RegExp +pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+NetBT: N\/A: A duplicate name has been detected on the TCP network\. .* +desc=$0 +action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@yourdomain.com + + + From 75c0e3d34b6fc334ddd3a50665c978d13608b781 Mon Sep 17 00:00:00 2001 From: Chris Petersen Date: Wed, 6 Dec 2006 23:02:29 +0000 Subject: [PATCH 02/32] Upgrade to sec 2.4.0 --- .cvsignore | 2 +- sec.spec | 15 ++++++--------- sources | 2 +- 3 files changed, 8 insertions(+), 11 deletions(-) diff --git a/.cvsignore b/.cvsignore index e066934..d95dd22 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -sec-2.3.3.tar.gz +sec-2.4.0.tar.gz diff --git a/sec.spec b/sec.spec index f531410..bb9e2eb 100644 --- a/sec.spec +++ b/sec.spec @@ -4,8 +4,8 @@ # Name: sec -Version: 2.3.3 -Release: 4%{?dist} +Version: 2.4.0 +Release: 1%{?dist} Summary: SEC (simple event correlator) Group: System Environment/Daemons @@ -81,12 +81,6 @@ write its output events to a file stream. %prep %setup -q -# Install some handy tools - mkdir tools/ - mv itostream.c \ - convert.pl \ - tools/ - # Replace some tags in the config files sed -i -e 's/@@NAME@@/%{name}/' \ %{SOURCE1} \ @@ -185,7 +179,7 @@ rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root,-) -%doc ChangeLog COPYING README tools/ +%doc ChangeLog COPYING README %config(noreplace) %{_sysconfdir}/sysconfig/sec %config(noreplace) %verify (not md5 size mtime) %{_sysconfdir}/logrotate.d/sec %{_sysconfdir}/%{name} @@ -199,6 +193,9 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Wed Dec 06 2006 Chris Petersen 2.4.0-1 +- Update to 2.4.0 + * Mon Jun 12 2006 Chris Petersen 2.3.3-4 - Change group to keep rpmlint happy - Fix permissions on the logrotate script diff --git a/sources b/sources index 8fabc54..57cc393 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -1b714a7dbb71e165327886a329f6d1e0 sec-2.3.3.tar.gz +3697bdab0664d5392c8e1e66edd3291c sec-2.4.0.tar.gz From 44401256cb2cdb96eacf7c923bb68726c85d3c2f Mon Sep 17 00:00:00 2001 From: Chris Petersen Date: Mon, 28 May 2007 20:06:22 +0000 Subject: [PATCH 03/32] Upgrade to 2.4.1 --- .cvsignore | 2 +- sec.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.cvsignore b/.cvsignore index d95dd22..de0ad9e 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -sec-2.4.0.tar.gz +sec-2.4.1.tar.gz diff --git a/sec.spec b/sec.spec index bb9e2eb..6486856 100644 --- a/sec.spec +++ b/sec.spec @@ -1,10 +1,11 @@ -# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345 # # Specfile for SEC, the simple event correlator # +# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345 +# Name: sec -Version: 2.4.0 +Version: 2.4.1 Release: 1%{?dist} Summary: SEC (simple event correlator) @@ -193,6 +194,9 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Mon May 28 2007 Chris Petersen 2.4.1-1 +- Update to 2.4.1 + * Wed Dec 06 2006 Chris Petersen 2.4.0-1 - Update to 2.4.0 diff --git a/sources b/sources index 57cc393..c2c00db 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -3697bdab0664d5392c8e1e66edd3291c sec-2.4.0.tar.gz +f233b3acf7cebdb573f4ff1f441866c3 sec-2.4.1.tar.gz From 0726551e6af36f1b516fe627a1c308be20055e45 Mon Sep 17 00:00:00 2001 From: Tom Callaway Date: Thu, 4 Sep 2008 16:58:27 +0000 Subject: [PATCH 04/32] fix license tag --- sec.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sec.spec b/sec.spec index 6486856..8bd8fe5 100644 --- a/sec.spec +++ b/sec.spec @@ -6,11 +6,11 @@ Name: sec Version: 2.4.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: SEC (simple event correlator) Group: System Environment/Daemons -License: GPL +License: GPLv2+ URL: http://www.estpak.ee/~risto/sec/ ################################################################################ @@ -193,6 +193,8 @@ rm -rf $RPM_BUILD_ROOT ################################################################################ %changelog +* Thu Sep 4 2008 Tom "spot" Callaway - 2.4.1-2 +- fix license tag * Mon May 28 2007 Chris Petersen 2.4.1-1 - Update to 2.4.1 From b6888f84fd6febccdd194a1ecc60d31cb5cdff12 Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Thu, 26 Feb 2009 00:21:13 +0000 Subject: [PATCH 05/32] - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 8bd8fe5..44a24db 100644 --- a/sec.spec +++ b/sec.spec @@ -6,7 +6,7 @@ Name: sec Version: 2.4.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: SEC (simple event correlator) Group: System Environment/Daemons @@ -193,6 +193,9 @@ rm -rf $RPM_BUILD_ROOT ################################################################################ %changelog +* Wed Feb 25 2009 Fedora Release Engineering - 2.4.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + * Thu Sep 4 2008 Tom "spot" Callaway - 2.4.1-2 - fix license tag From 1741e519f2f9b3ccb5ea3f0bad11877311761e44 Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Mon, 27 Jul 2009 04:07:02 +0000 Subject: [PATCH 06/32] - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild --- sec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 44a24db..a4318c3 100644 --- a/sec.spec +++ b/sec.spec @@ -6,7 +6,7 @@ Name: sec Version: 2.4.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: SEC (simple event correlator) Group: System Environment/Daemons @@ -193,6 +193,9 @@ rm -rf $RPM_BUILD_ROOT ################################################################################ %changelog +* Sun Jul 26 2009 Fedora Release Engineering - 2.4.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + * Wed Feb 25 2009 Fedora Release Engineering - 2.4.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild From 2c1efa8e94704fd4168b43e107073bccd9eca6e9 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 3 Oct 2009 07:52:15 +0000 Subject: [PATCH 07/32] - New upstream release - SPEC file cleanup - Init script cleanup - Removed some examples because of licensing issues. Upstream has clarified and changed most of the license tags to GPLv2. Additionally, upstream will include the examples in the next release. - Removed a provide statement since a period was in the name and no other package required that special name. --- .cvsignore | 2 +- 001_init.sec | 19 - amavisd.sec | 10 +- bsd-MONITOR.sec | 11 +- bsd-PHYSMOD.sec | 8 +- bsd-USERACT.sec | 7 +- general.sec => bsd-general.sec | 37 +- mpd.sec => bsd-mpd.sec | 8 + cisco-syslog.sec | 477 +++++++++++++++ clamav.sec | 8 - conf.README | 16 +- cvs.sec | 14 +- dameware.sec | 11 +- dbi-example.sec | 25 - hp-openview.sec | 6 +- import.log | 1 + labrea.sec | 11 +- pix-general.sec | 1046 ++++++++++++++++++++++++++++++++ pix-security.sec | 37 +- pix-url.sec | 7 +- portscan.sec | 7 +- sec.init | 144 +++-- sec.logrotate | 2 +- sec.spec | 229 +++---- snort.sec | 16 +- snortsam.sec | 19 +- sources | 2 +- ssh-brute.sec | 12 +- ssh.sec | 21 +- syslog-ng.txt | 95 --- vtund.sec | 20 +- windows.sec | 15 +- 32 files changed, 1879 insertions(+), 464 deletions(-) delete mode 100644 001_init.sec rename general.sec => bsd-general.sec (87%) rename mpd.sec => bsd-mpd.sec (56%) create mode 100644 cisco-syslog.sec delete mode 100644 clamav.sec delete mode 100644 dbi-example.sec create mode 100644 import.log create mode 100644 pix-general.sec delete mode 100644 syslog-ng.txt diff --git a/.cvsignore b/.cvsignore index de0ad9e..d14f9ac 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -sec-2.4.1.tar.gz +sec-2.5.2.tar.gz diff --git a/001_init.sec b/001_init.sec deleted file mode 100644 index 2858f15..0000000 --- a/001_init.sec +++ /dev/null @@ -1,19 +0,0 @@ -### Logfile & global variable initialization - -type = Single -ptype = RegExp -pattern = (SEC_STARTUP|SEC_RESTART|SEC_SHUTDOWN) -desc = SEC internal message -action = assign %mailto root@localhost; \ - assign %logfile /var/log/sec; \ - shellcmd /bin/echo -e -- "\n%t %s : $0\n" >> %logfile; \ - add SECPROD %t "starting : %s / $0" - -### Daily SEC report - -type = Calendar -time = 44 4 * * * -desc = Daily report -action = add SECPROD %t "Mailing report : '%s' to %mailto"; \ - report SECPROD /bin/mail -s "SEC REPORT: %s" %mailto - diff --git a/amavisd.sec b/amavisd.sec index d718395..d022e1c 100644 --- a/amavisd.sec +++ b/amavisd.sec @@ -1,5 +1,11 @@ -#Amavisd events - +############################################################################# +# Amavisd events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# #Sep 4 15:43:02 xxxxx clamd[581]: /var/amavisd/amavis-20050904T153955-46858/parts/part-00001: HTML.Phishing.Bank-1 FOUND type=Single diff --git a/bsd-MONITOR.sec b/bsd-MONITOR.sec index 302e0de..889ec98 100644 --- a/bsd-MONITOR.sec +++ b/bsd-MONITOR.sec @@ -1,9 +1,14 @@ # -# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# # SEC rules to pick up disruptive monitoring # events. # +# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# Copyright (C) 2003-2009 Jim Brown +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +# #Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) #---------------------------------------------------------------------- #Nov 15 20:02:48 foohost syslogd: exiting on signal 15 @@ -50,5 +55,5 @@ type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+kernel: swap_pager_getswapspace\(\S\): .* desc=$0 -action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@yourdomain.com +action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@example.com diff --git a/bsd-PHYSMOD.sec b/bsd-PHYSMOD.sec index bb44dea..03b348f 100644 --- a/bsd-PHYSMOD.sec +++ b/bsd-PHYSMOD.sec @@ -1,9 +1,13 @@ # -# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# # PHYSMOD.conf - Events concerning physical modifications # to the system. # +# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html +# +# Copyright (C) 2003-2009 Jim Brown +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. # #Logs involving physical modifications (PHYSMOD) #------------------------------------------------ diff --git a/bsd-USERACT.sec b/bsd-USERACT.sec index 44227a9..edf2557 100644 --- a/bsd-USERACT.sec +++ b/bsd-USERACT.sec @@ -1,7 +1,12 @@ # +# Events concerning user activities. +# # From http://sixshooter.v6.thrupoint.net/SEC-examples/article.html # -# Events concerning user activities. +# Copyright (C) 2003-2009 Jim Brown +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. # #Logs involving logins, change of UID and privilege escalations (USERACT) #------------------------------------------------------------------------- diff --git a/general.sec b/bsd-general.sec similarity index 87% rename from general.sec rename to bsd-general.sec index 99856ff..457b39b 100644 --- a/general.sec +++ b/bsd-general.sec @@ -1,5 +1,10 @@ # General log events, unix systems. From various sources # +# Copyright (C) 2003-2009 Jim Brown +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +# # Bad su # ----------- # @@ -7,13 +12,13 @@ type=Single ptype=RegExp desc=$0 pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) -action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@email.com +action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com type=Single ptype=RegExp desc=$0 pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) -action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@email.com +action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com # MONITOR.conf - SEC rules to pick up disruptive monitoring @@ -94,7 +99,7 @@ action=write - USERACT: $1 sshd accepted login, text: $2 at %t #ptype=RegExp #pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: error: PAM: authentication error for (/S+) from (/S+) #desc=$0 -#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' +#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' alerts@example.com # # su bad @@ -104,7 +109,7 @@ type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) desc=$0 -action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com #Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 #Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 @@ -118,7 +123,7 @@ type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) desc=$0 -action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com #action=write - USERACT: $1 su: $2 to ROOT on $4 at %t # @@ -158,7 +163,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) desc=$0 -action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' +action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com #action=event 0 $1 USERACT:YELLOW sshd $2 problem, text: $3 at %t # @@ -169,7 +174,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(sshd|login): (.*?FAILURE.)(.*?ON) (.*) desc=$0 -action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' +action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com #action=event 0 $1 USERACT:YELLOW login $2 on $4 at %t @@ -190,7 +195,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+named\[\d+\]: client (\S+): request has invalid signature:(.*) desc=$0 -action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" +action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" alerts@example.com # # MAC address moved @@ -200,7 +205,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: arp: (\S+) moved from (\S+) to (\S+) on (\S+) desc=$0 -action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" +action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" alerts@example.com # # DoS RST rate limit @@ -210,7 +215,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Limiting closed port RST response from (\d+) to (\d+) desc=$0 -action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" +action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" alerts@example.com @@ -230,7 +235,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+ntpd\[\d+\]: ntpd exiting on signal (\d+) desc=$0 -action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" +action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" alerts@example.com # # Process crash @@ -240,7 +245,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pid \d+ \(\S+\), uid (\d+): exited on signal (\d+) desc=$0 -action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" +action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" alerts@example.com @@ -258,7 +263,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(thttpd)\[(\d+)\]:(.*) desc=$0 -action=pipe 'SUSPROC: $1 suspicious process $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process $2" +action=pipe 'SUSPROC: $1 suspicious process $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process $2" alerts@example.com @@ -278,7 +283,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+reboot: rebooted by (\S+) desc=$0 -action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" +action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" alerts@example.com # # Halt message @@ -288,7 +293,7 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+halt: halted by (\S+) desc=$0 -action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" +action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" alerts@example.com # # Restart message @@ -298,5 +303,5 @@ type=Single ptype=RegExp pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Copyright \(c\) (\S+) The FreeBSD Project desc=$0 -action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" +action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" alerts@example.com diff --git a/mpd.sec b/bsd-mpd.sec similarity index 56% rename from mpd.sec rename to bsd-mpd.sec index cd9b476..594c556 100644 --- a/mpd.sec +++ b/bsd-mpd.sec @@ -1,3 +1,11 @@ +############################################################################# +# BSD mpd events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=single desc = mpd connection start diff --git a/cisco-syslog.sec b/cisco-syslog.sec new file mode 100644 index 0000000..3ee22ea --- /dev/null +++ b/cisco-syslog.sec @@ -0,0 +1,477 @@ +############################################################################# +# SEC rules for processing Cisco syslog messages +# +# Copyright (C) 2008-2009 Omer Ben-Shalom, Risto Vaarandi +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# + +# ----- Process system configuration events ----- + +# System configuration events +# suppressed because we don't care about it +# +type=suppress +ptype=substr +pattern=%SYS-5-CONFIG_I: +desc=device configuration + +# System configuration sync to standby router +# suppressed because we don't care about it +# +type=suppress +ptype=substr +pattern=%PFINIT-SP-5-CONFIG_SYNC: +desc=config sync + +# ----- Process reload and restart events ----- + +# Looks for a reload +# +type=single +continue=takeNext +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: (.*) +desc=(WARNING) reload requested for $1 +action=pipe '%s details:$2' mail -s 'cisco event' root@example.com + +# Looks for a reload followed by a restart event +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: +desc=(CRITICAL) $1 RELOAD_PROBLEM +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1).*?%SYS-5-RESTART: +desc2=(NOTICE) $1 RELOAD_OK +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=300 + +# Looks for a restart without reload command +# +type=single +ptype=regexp +pattern=(\S+) \d+:.*?%SYS-5-RESTART: +desc=(CRITICAL) $1 restart without reload command +action=pipe '%s' mail -s 'cisco event' root@example.com + +# ----- process SNMP authentication failure events ----- + +# this rule handles the SNMP authentication failures +# only one notification is sent for each source that is doing this per day +# +type=singleWithSuppress +ptype=regexp +pattern=(\S+) \d+:.*?%SNMP-3-AUTHFAIL: Authentication failure for SNMP req from host (\S+) +desc=(WARNING) Auth fail coming from $2 +action=pipe '%s' mail -s 'cisco event' root@example.com +window=86400 + +# ----- process OSPF neighbor change events ----- + +# This rule handles OSPF neighbor changes +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OSPF-5-ADJCHG:.*?Nbr (\S+) on (\S+) from (\S+) to (\S+), (.*) +desc=(MINOR) OSPF adjacency change: Router $1 reports that the neighbor on $3 ($2) changed from state $4 to state $5 detail:$6 +action=event %s; pipe '%s' mail -s 'cisco event' root@example.com + +# This rule escalates to CRITICAL if there are more than 5 neighbor changes +# in 5 seconds +# +type=SingleWithThreshold +ptype=substr +pattern=(MINOR) OSPF adjacency change +desc=(CRITICAL) More than 5 OSPF neighbor changes in 5 seconds +action=pipe '%s' mail -s 'cisco event' root@example.com +thresh=5 +window=5 + +# ----- process HSRP events ----- + +# This rule assembles together all HSRP events +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%STANDBY-6-STATECHANGE: (\S+).*?state (\S+) -> (\S+) +desc=HSRP change for $1 interface $2 - changed from $3 to $4 +action=add HSRP_$1 %t: %s; set HSRP_$1 5 (report HSRP_$1 mail -s 'cisco events' root@example.com) + +# ----- process duplex mismatch events ----- + +# this rule handles the duplex mismatch event +# only one notification is sent for each port that has duplex mismatch +# reported per day +# +type=singleWithSuppress +ptype=regexp +pattern=(\S+) \d+:.*?%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on (not \S+) \((.*?)\), with (\S+) (\S+) \((.*?)\) +desc=(WARNING) Duplex mismatch between $1 port $2 ($3), other side is $4 port $5 ($6) +action=pipe '%s' mail -s 'cisco event' root@example.com +window=86400 + +# ----- process link down and link up events ----- + +# This rule deals with link down events +# +type=PairWithWindow +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINK-3-UPDOWN: Interface (\S+), changed state to down +desc=(MINOR) $1 INTERFACE $2 DOWN and not up in one minute +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=RegExp +pattern2=($1)\s+\d+:.*?%LINK-3-UPDOWN: Interface ($2), changed state to up +desc2=(WARNING) %1 INTERFACE %2 BOUNCE +action2=event %s +window=60 + +# when the first bounce event is seen, create a reporting trigger +# +type=Single +continue=TakeNext +ptype=regexp +pattern=(\S+) INTERFACE \S+ BOUNCE +context=!INTERFACE_BOUNCE_WAIT_$1 +desc=interface bounce summary event for router $1 +action=create INTERFACE_BOUNCE_WAIT_$1 10 (report INTERFACE_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete INTERFACE_BOUNCE_$1) + +# accumulate all interface bounce events into a context +# +type=Single +ptype=regexp +pattern=(\S+) INTERFACE (\S+) BOUNCE +desc=interface bounce for router $1 interface $2 detected +action=add INTERFACE_BOUNCE_$1 %t: %s + +# ----- process line protocol down and line protocol up events ----- + +# This rule deals with protocol up/down events +# +type=PairWithWindow +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface (\S+), changed state to down +desc=(MINOR) $1 INTERFACE $2 line protocol DOWN and not up in one minute +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=RegExp +pattern2=($1)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface ($2), changed state to up +desc2=(WARNING) %1 INTERFACE %2 line protocol BOUNCE +action2=event %s +window=60 + +# when the first bounce event is seen, create a reporting trigger +# +type=Single +continue=TakeNext +ptype=regexp +pattern=(\S+) INTERFACE \S+ line protocol BOUNCE +context=!LINE_PROTOCOL_BOUNCE_WAIT_$1 +desc=line protocol bounce for router $1 +action=create LINE_PROTOCOL_BOUNCE_WAIT_$1 10 (report LINE_PROTOCOL_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete LINE_PROTOCOL_BOUNCE_$1) + +# accumulate all line protocol bounce events into a context +# +type=Single +ptype=regexp +pattern=(\S+) INTERFACE (\S+) line protocol BOUNCE +desc=line protocol bounce for router $1 interface $2 detected +action=add LINE_PROTOCOL_BOUNCE_$1 %t: %s + +# ----- process late collision events ----- + +# Late collision alerts +# +type=SingleWithThreshold +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%PM_SCP-SP-4-LCP_FW_ABLC: Late collision message from module (\d+), port:(\d+) +desc=(MINOR) Multiple late collision events on $1 module $2 port $3 +action=pipe '%s' mail -s 'cisco event' root@example.com +window=3600 +thresh=5 + +# ----- process host flap events ----- + +# host flapping on single vlan +# +type=SingleWithThreshold +continue=TakeNext +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+) +desc=(MINOR) multiple hosts flapping between ports $4 and $5 in $1 vlan $3 +action=pipe '%s' mail -s 'cisco event' root@example.com +window=300 +thresh=5 + +# host flapping on multiple vlans +# +type=SingleWithThreshold +continue=TakeNext +ptype=RegExp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+) +desc=(MINOR) multiple hosts are flapping between ports $4 and $5 in $1 (potentially on multiple VLANs) +action=pipe '%s' mail -s 'cisco event' root@example.com +window=300 +thresh=20 + +# ----- process misc hw events ----- + +# %FILESYS-SP-STDBY-5-DEV:# flash disk removal +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%FILESYS-SP-STDBY-5-DEV:.*?PCMCIA flash card removed from (\S+) +desc=(WARNING) Flash card removed from $1 $2 +action=pipe '%s' mail -s 'cisco event' root@example.com + +# %OIR-SP-STDBY-6-CONSOLE +# +type=suppress +ptype=substr +pattern=%OIR-SP-STDBY-6-CONSOLE +desc=console access to route processor changed + +# %OIR-SP-6-INSCARD: - card inserted +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OIR-SP-6-INSCARD: Card inserted in slot (\d+), (.*) +desc=(HARMLESS) card inserted in $1 slot $2 status:$3 +action=pipe '%s' mail -s 'cisco event' root@example.com + +# ----- process module events ----- + +# %DIAG-SP-3-TEST_FAIL - diagnostics failed on a module +# +type=single +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DIAG-SP-3-TEST_FAIL: Module (\d+): (.*) +desc=(WARNING) diagnostics failed for $1 module $2 detail:$3 +action=pipe '%s' mail -s 'cisco event' root@example.com + +# %SNMP-5-MODULETRAP +# Looks for a module down followed by module up event +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-MODULETRAP: Module (\d+) [Down] Trap +desc=(MINOR) $1 Module DOWN (not back up in a minute) +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1) .*? %SNMP-5-MODULETRAP: Module ($2) [Up] Trap +desc2=(WARNING) $1 Module $2 BOUNCE (down and back up within a minute) +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=60 + +# ----- process irrelevant events (by suppressing) ----- + +# %SYS-SP-STDBY-5-RESTART - system restarted part of the boot - interesting? +# +type=suppress +ptype=substr +pattern=SYS-SP-STDBY-5-RESTART +desc=system restarted + +# %DIAG-SP-6-TEST_RUNNING - Running system test +# +type=suppress +ptype=substr +pattern=%DIAG-SP-6-TEST_RUNNING +desc=running diagnostics on a module + +# %FABRIC-SP-5-FABRIC_MODULE_BACKUP - module changed to backup state +# +type=suppress +ptype=substr +pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP +desc=module became backup + +# %DIAG-SP-6-RUN_MINIMUM - diagnostics are run +# +type=suppress +ptype=substr +pattern=%DIAG-SP-6-RUN_MINIMUM +desc=diagnostics running on switch + +# %DIAG-SP-6-DIAG_OK - diagnostics results are OK +# +type=suppress +ptype=substr +pattern=%DIAG-SP-6-DIAG_OK +desc=diagnostics results are OK + +# %PFREDUN-SP-STDBY-6-STANDBY - SSO events +# +type=suppress +ptype=substr +pattern=%PFREDUN-SP-STDBY-6-STANDBY +desc=SSO event (startup) + +# %PFREDUN-SP-STDBY-6-STANDBY - SSO events +# +type=suppress +ptype=substr +pattern=%PFREDUN-SP-6-ACTIVE +desc=SSO event (startup) + +# %FABRIC-SP-5-FABRIC_MODULE_BACKUP: - secondary sup is up and is secondary +# +type=suppress +ptype=substr +pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP: +desc=secondary sup is up and is secondary + +# %PFINIT-SP-5-CONFIG_SYNC - startup config on standby router sync +# +type=suppress +ptype=substr +pattern=%PFINIT-SP-5-CONFIG_SYNC +desc=startup config on standby router sync + +# %C4K_REDUNDANCY - Cayt 4K configuration/vlan database succesful sync +# the success match is to allow fails in sync to not be suppress +# +type=suppress +ptype=regexp +pattern=%C4K_REDUNDANCY.*?success +desc=config sync with standby supervisor + +# %SCP-SP-5-ASYNC_WATERMARK: SCP long queue wait +# the success match is to allow fails in sync to not be suppress +# +type=suppress +ptype=substr +pattern=%SCP-SP-5-ASYNC_WATERMARK: +desc=SCP control protocol pending queue is longer than notification threshold + +# %MLS_RATE-4-DISABLING: - Layer2 Rate Limiters have been disabled. Is this interesting? +# +type=suppress +ptype=substr +pattern=%MLS_RATE-4-DISABLING: +desc=Layer2 Rate Limiters have been disabled + +# ----- process native VLAN mismatch events ----- + +# %CDP-4-NATIVE_VLAN_MISMATCH: - native VLAN mismatch between switches, will repeat every minute until fixed +# +type=singleWithSuppress +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on (\S+) \((\d+)\), with (\S+) (\S+) \((\d+)\) +desc=(MINOR) A native VLAN mistmatch reported between $1 interface $2 (native VLAN $3) and host $4 interface $5 (native VLAN $6) +action=pipe '%s' mail -s 'cisco event' root@example.com +window=60 + +# ----- process snmp trapblock messages ----- + +# %SNMP-3-TRAPBLOCK - A process tried to create a trap it is not entitled to create +# See Cisco http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&counter=0&paging=5&query=SNMP-3-TRAPBLOCK +# +type=suppress +ptype=substr +pattern=%SNMP-3-TRAPBLOCK +desc=a process tried to create a trap it is not entitled to create + +# ----- process chassis alarm events ----- + +# %SNMP-5-CHASSISALARM - this rule handles the tmpAlarm +# +type=pairWithWindow +continue=takeNext +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(ON\) +desc=(MINOR) $1 temprature alarm signaled and not cleared in five minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +continue2=takeNext +ptype2=regexp +pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(OFF\) +desc2=(WARNING) $1 temprature alarm went on and was cleared in under five minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=300 + +# %SNMP-5-CHASSISALARM - this rule handles the minorAlarm +# +type=pairWithWindow +continue=takeNext +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(ON\) +desc=(MINOR) $1 minor alarm reported and not cleared in three minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +continue2=takeNext +desc2=(WARNING) $1 minor alarm went on and was cleared in under three minutes +ptype2=regexp +pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(OFF\) +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=180 + +# %SNMP-5-CHASSISALARM - this rule handles the majorAlarm +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(ON\) +desc=(MINOR) $1 major alarm signaled and not cleared in two minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(OFF\) +desc2=(WARNING) $1 major alarm went on and was cleared in under two minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=120 + +# ----- process power supply related events ----- + +# %C4K_IOSMODPORTMAN events - this one is about power supplies only +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD: Power Supply (\d+) has failed or been turned off +desc=(MINOR) $1 power supply $2 reported bad and event not cleared in two minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1) .*? %C4K_IOSMODPORTMAN-6-POWERSUPPLYGOOD: Power Supply ($2) is Okay +desc2=(WARNING) $1 power supply $2 alarm went on and was cleared in under two minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=120 + +# ----- process neighbor down and neighbor up events ----- + +# %DVMRP-5-NBRDOWN +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DVMRP-5-NBRDOWN: Neighbor (\S+) went down on (\S+) +desc=(MINOR) $1 lost DVMRP neighbor $2 on interface $3 and it did not come up in two minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1) .*? %DVMRP-5-NBRUP: Neighbor ($2) is up on ($3) +desc2=(WARNING) $1 lost DVMRP neighbor $2 on interface $3 but id come up within two minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=120 + +# ----- process fan power supply failure/ok events ----- + +# %C6KENV-SP-4-PSFANF events - this one is about fan failures +# +type=pairWithWindow +ptype=regexp +pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C6KENV-SP-4-PSFANFAILED: the fan in power supply (\d+) has failed +desc=(MINOR) $1 fan in power supply $2 was reported bad and event not cleared in two minutes +action=pipe '%s' mail -s 'cisco event' root@example.com +ptype2=regexp +pattern2=($1) .*? %C6KENV-SP-4-PSFANOK: the fan in power supply (\d+) is OK +desc2=(WARNING) $1 fan in power supply $2 alarm went on and was cleared in under two minutes +action2=pipe '%s' mail -s 'cisco event' root@example.com +window=120 + +# ----- process events that have not been matched by any of above rules ----- + +# Default match +# this rule will match anything not previously matched but allows only +# one notification per day for each new event class seen +# +type=singleWithSuppress +ptype=regexp +pattern=(%.*?:) +desc=$1 +action=pipe '$0' mail -s 'cisco event' root@example.com +window=86400 diff --git a/clamav.sec b/clamav.sec deleted file mode 100644 index 6ab594f..0000000 --- a/clamav.sec +++ /dev/null @@ -1,8 +0,0 @@ -#Detects Clamav syslogs and reports them in a general report - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND -desc=$0 -action=add GENERAL_REPORT CLAMD: $2 on $1 - diff --git a/conf.README b/conf.README index a25550f..7365c13 100644 --- a/conf.README +++ b/conf.README @@ -1,10 +1,10 @@ -This is the SEC configuration directory. Because SEC usage varies so widely -from user to user, this Fedora Extras package is configured by default to not -run. +This is the SEC configuration directory. Because SEC usage varies so widely +from user to user, this package is configured by default to not run. The commented-out default settings in /etc/sysconfig/sec will load any file in -this directory with a .sec suffix. Please look through the example files -included in /etc/sec/examples/ and install the ones you want here (taking into -account that the examples are generic and some of them may need to be tweaked -to work with your setup). You should also read the SEC man page so you have -at least a basic understanding of the SEC configuration commands. +this directory with a .sec suffix. Please look through the example files +included in /usr/share/doc/sec-/examples/ and install the ones you +want here (taking into account that the examples are generic and some of them +may need to be tweaked to work with your setup). You should also read the SEC +man page so you have at least a basic understanding of the SEC configuration +commands. diff --git a/cvs.sec b/cvs.sec index f0f67c4..ae5af5d 100644 --- a/cvs.sec +++ b/cvs.sec @@ -1,3 +1,11 @@ +############################################################################# +# CVS events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# #Jul 31 19:54:21 xxxx xinetd[2088]: START: cvspserver pid=16385 from=xx.xx.xx.xx @@ -14,7 +22,7 @@ type=single ptype=regexp pattern=([A-z._0-9-]*) cvs: password mismatch for (.*) in (.*) desc = cvs login failure -action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@yourdomain.com +action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@example.com #Aug 5 10:38:49 xxxx cvs: attempt to root from account: username @@ -23,7 +31,7 @@ type=single ptype=regexp pattern=([A-z._0-9-]*) cvs: attempt to root from account: (.*) desc = cvs login to root attempt -action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@yourdomain.com +action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@example.com #Aug 5 10:42:37 xxxx cvs: login failure (for /usr/local/cvsroot) @@ -32,5 +40,5 @@ type=single ptype=regexp pattern=([A-z._0-9-]*) cvs: login failure \(for /usr/local/cvsroot\) desc = cvs login failure -action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@yourdomain.com +action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@example.com diff --git a/dameware.sec b/dameware.sec index ad840a8..8dd5201 100644 --- a/dameware.sec +++ b/dameware.sec @@ -1,10 +1,19 @@ +############################################################################# +# Dameware events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# + #Dameware Connect type=single ptype=regexp pattern=([A-z._0-9-]*) DMWRCS: (.*) Connect: (.*) desc = Dameware Connect action=add WINDOWS_REPORT DAMEWARE CONNECT: %s; \ -pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@yourdomain.com +pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@example.com #Dameware Disconnect diff --git a/dbi-example.sec b/dbi-example.sec deleted file mode 100644 index 046e1c4..0000000 --- a/dbi-example.sec +++ /dev/null @@ -1,25 +0,0 @@ -# to use perl packages, like DBI, you need to start SEC with the *-intevents* flag. -# this rule gets run against the messages file to log events to a central DB. -# not so much for the rule itself, but an example using DBI: -# Submitted by Jason Chambers - -type=Single -ptype=RegExp -pattern=^(\S+\s+\S+\s+\S+)\s+(\S+)\s+(\S+:)\s+(\S+\s+\S+\s+\S+\s+)?(\S+)\s+:\s+\S+\s+;\s+(\S+)\s+;\s+(\S+)\s+;\s+(.*) -desc=update db log -action=assign %H $2;\ - assign %Z $5;\ - assign %U $6;\ - assign %R $7;\ - assign %C $8;\ - assign %N %u;\ - assign %I 0;\ - eval %I (require DBI);\ - eval %D (exit(1) unless %I;\ - $COMMAND = "%C";\ - my $DBH = DBI->connect('DBI:mysql:/DBname/:/DBhost/', '/DBuser/', '/DBpass/');\ - my $SQL = " SQL statement";\ - $DBH->do($SQL);\ - ); - - diff --git a/hp-openview.sec b/hp-openview.sec index 17db678..d579dbf 100644 --- a/hp-openview.sec +++ b/hp-openview.sec @@ -1,10 +1,14 @@ ################################################################ # Sample SEC ruleset for HP OpenView ITO +# +# Copyright (C) 2003-2009 Risto Vaarandi +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. ################################################################ # process Cisco linkDown/linkUp trap events received from # HP OpenView ITO trap template through itostream plugin -# Submitted by Risto Vaarandi type=PairWithWindow ptype=RegExp diff --git a/import.log b/import.log new file mode 100644 index 0000000..2fdc0a3 --- /dev/null +++ b/import.log @@ -0,0 +1 @@ +sec-2_5_2-1_fc11:F-12:sec-2.5.2-1.fc11.src.rpm:1254556293 diff --git a/labrea.sec b/labrea.sec index 040bed2..d27153a 100644 --- a/labrea.sec +++ b/labrea.sec @@ -1,4 +1,11 @@ -#Labrea tarpit events +############################################################################# +# Labrea tarpit events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=Single ptype=RegExp @@ -25,5 +32,5 @@ type=Calendar time=0 8,12,20 * * * desc=Sending tarpit report... action=report TARPIT_REPORT \ - /usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@yourdomain.com; \ + /usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@example.com; \ delete TARPIT_REPORT diff --git a/pix-general.sec b/pix-general.sec new file mode 100644 index 0000000..1aa9b87 --- /dev/null +++ b/pix-general.sec @@ -0,0 +1,1046 @@ +#################################################################### +# SEC ruleset for Cisco PIX 6.x, 7.x, FWSM 2.x +# +# Copyright (C) 2003-2009 Colin Hudler +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +#################################################################### + +# Process various events from PIX syslog output +# +# TODO -- A few FWSM log lines will not match. + +# Setup our variables -- not the right way to do this? Needs tweaking for your log lines +type=Single +ptype=RegExp +pattern=^(.* [0-9].:[0-9].:[0-9].) (.*)\.yourdomain\.edu.*?%(PIX|FWSM)-[0-9]-.*?:(.*) +desc=PIXLOG $2^ $1 $4 +action=event %s + +# 106001 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Inbound TCP connection denied from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+).* +desc=PIX $1 TCP connection denid HAMMER $2 to $3 +action=create ham1_$1; add ham1_$1 %t; add ham1_$1 %s;add ham1_$1 %s; add ham1_$1 $0; report ham1_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham1_$1 +window=10 +thresh=6 + +# 106006 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Connection denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+) +desc=PIX $1 denied by list HAMMER $2 to $3 +action=create ham2_$1; add ham2_$1 %t; add ham2_$1 %s; add ham2_$1 $0; report ham2_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham2_$1 +window=10 +thresh=6 + +# 106007 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny inbound UDP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) due to DNS.* +desc=PIX $1 Denied inbound UDP HAMMER $2 to $3 +action=create ham3_$1; add ham3_$1 %t; add ham3_$1 %s; add ham3_$1 $0; report ham3_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham3_$1 +window=10 +thresh=6 + +# 106010 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny inbound.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+).* +desc=PIX $1 Denied inbound HAMMER $2 to $3 +action=create ham4_$1; add ham4_$1 %t; add ham4_$1 %s; add ham4_$1 $0; report ham4_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham4_$1 +window=10 +thresh=6 + +# 106012 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny IP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+), IP options.* +desc=PIX $1 Denied IP Options HAMMER $2 to $3 +action=create ham5_$1; add ham5_$1 %t; add ham5_$1 %s; add ham5_$1 $0; report ham5_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham5_$1 +window=10 +thresh=6 + +# 106013 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Dropping echo request from (\d+.\d+.\d+.\d+) to PAT address +desc=PIX $1 Echo HAMMER $2 to PAT Address +action=create ham6_$1; add ham6_$1 %t; add ham6_$1 %s; add ham6_$1 $0; report ham7_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham8_$1 +window=10 +thresh=6 + +# 106014 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny inbound icmp src.*: (\d+.\d+.\d+.\d+) dst.*: (\d+.\d+.\d+.\d+) +desc=PIX $1 Deny inbound ICMP HAMMER $2 to $3 +action=create ham9_$1; add ham9_$1 %t; add ham9_$1 %s; add ham9_$1 $0; report ham9_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham9_$1 +window=10 +thresh=6 + +# 106015 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny.*\(no connection\) from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Deny (no connection) HAMMER $2 to $3 +action=create ham10_$1; add ham10_$1 %t; add ham10_$1 %s; add ham10_$1 $0; report ham10_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham10_$1 +window=10 +thresh=30 + +# 106016,106017,106020,106021,106022 is further down this list... + +# 106018 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*ICMP packet type.*denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+) +desc=PIX $1 Deny ICMP type HAMMER $2 to $3 +action=create ham11_$1; add ham11_$1 %t; add ham11_$1 %s; add ham11_$1 $0; report ham11_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham11_$1 +window=10 +thresh=6 + +# 106023 +#Deny udp src outside:128.135.93.11/137 dst inside:128.135.211.65/137 by access-group "inward" +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+) by .* +desc=PIX $1 Deny by ACL HAMMER $2 to $3 +action=create ham12_$1; add ham12_$1 %t; add ham12_$1 %s; add ham12_$1 $0; report ham12_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham12_$1 +window=10 +thresh=32 + +# This is broken... still fix? TODO +# 106001 -- Report +#type=SingleWithThreshold +#continue=takenext +#ptype=RegExp +#pattern=^PIXLOG (\S+)\^ .*(Inbound TCP connection denied from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+).*)|\ +#(Connection denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+))|\ +#(Deny inbound UDP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) due to DNS)|\ +#(Deny inbound.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+))|\ +#(Deny IP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+), IP options)|\ +#(Dropping echo request from (\d+.\d+.\d+.\d+) to PAT address)|\ +#(Deny inbound icmp src.*: (\d+.\d+.\d+.\d+) dst.*: (\d+.\d+.\d+.\d+))|\ +#(Deny.*\(no connection\) from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+))|\ +#(ICMP packet type.*denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+))|\ +#(Deny.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+) by ) +#desc=PIX Conn Denied 10 times from $2 +#action=create rpt_$1; add rpt_$1 %t; add rpt_$1 %s;add rpt_$1 %s; add rpt_$1 $0; report rpt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpt_$1 +#window=10 +#thresh=30 + +# 101002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Bad failover cable. +desc=PIX $1 Bad Failover Cable +action=create bfc_$1; add bfc_$1 %t; add bfc_$1 %s; add bfc_$1 $0; report bfc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete bfc_$1 + +# 101003/4 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Failover cable not connected +desc=PIX $1 Failover cable gone +action=create nfc_$1; add nfc_$1 %t; add nfc_$1 %s; add nfc_$1 $0; report nfc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nfc_$1 + +# 101005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Error reading failover cable status +desc=PIX $1 Failover cable ERROR +action=create fce_$1; add fce_$1 %t; add fce_$1 %s; add fce_$1 $0; report fce_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fce_$1 + +# 102001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Power failure/System reload +desc=PIX $1 Peer Lost Power +action=create fpp_$1; add fpp_$1 %t; add fpp_$1 %s; add fpp_$1 $0; report fpp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpp_$1 + +# 103001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*No response from other firewall +desc=PIX $1 Peer Gone Away +action=create fnp_$1; add fnp_$1 %t; add fnp_$1 %s; add fnp_$1 $0; report fnp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fnp_$1 + +# 103003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Other firewall network interface (\S+) failed +desc=PIX $1 Peer interface $2 died +action=create fpi_$1; add fpi_$1 %t; add fpi_$1 %s; add fpi_$1 $0; report fpi_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpi_$1 + +# 103004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Other firewall reports this firewall failed +desc=PIX $1 Peer says I failed +action=create fif_$1; add fif_$1 %t; add fif_$1 %s; add fif_$1 $0; report fif_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fif_$1 + +# 103005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Other firewall reporting failure +desc=PIX $1 Peer reports failure +action=create fpf_$1; add fpf_$1 %t; add fpf_$1 %s; add fpf_$1 $0; report fpf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpf_$1 + +# 104001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(Primary|Secondary) Switching to ACTIVE \(cause: (.*)\) +desc=PIX $1 FAILOVER! Becoming ACTIVE because $2 +action=create fba_$1; add fba_$1 %t; add fba_$1 %s; add fba_$1 $0; report fba_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fba_$1 + +# 104002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(Primary|Secondary) Switching to STNDBY \(cause: (.*)\) +desc=PIX $1 FAILOVER! Becoming STNDBY because $2 +action=create fbs_$1; add fbs_$1 %t; add fbs_$1 %s; add fsb_$1 $0; report fbs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fbs_$1 + +# 104003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Switching to FAILED +desc=PIX $1 IN FAILED STATE! +action=create ffs_$1; add ffs_$1 %t; add ffs_$1 %s; add ffs_$1 $0; report ffs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ffs_$1 + +# 104004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Switching to OK. +desc=PIX $1 Failed Unit is ok +action=create ffs_$1; add ffs_$1 %t; add ffs_$1 %s; add ffs_$1 $0; report ffs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ffs_$1 + +# 105005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Lost Failover communications with mate on interface +desc=PIX $1 Peer Gone Away +action=create fnp_$1; add fnp_$1 %t; add fnp_$1 %s; add fnp_$1 $0; report fnp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fnp_$1 + +# 105007 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Link status \'Down\' on interface (\S+).* +desc=PIX $1 interface $2 is DOWN +action=create ind_$1; add ind_$1 %t; add ind_$1 %s; add ind_$1 $0; report ind_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ind_$1 + +# 105011 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Failover cable communication failure +desc=PIX $1 Failver cable failed +action=create fcf_$1; add fcf_$1 %t; add fcf_$1 %s; add fcf_$1 $0; report fcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fcf_$1 + +# 105021 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Standby unit failed to sync due to a locked (\S+) config. Lock held by (\S+) +desc=PIX $1 Failover Sync failed because $2 is locked by $3 +action=create lck_$1; add fcf_$1 %t; add fcf_$1 %s; add lck_$1 $0; report lck_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lck_$1 + +# 10532 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LAN Failover interface is down +desc=PIX $1 Failover interface is down +action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 + +# 10535 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Receive a LAN failover interface down msg from peer. +desc=PIX $1 Failover Peer reports LAN interface down +action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 + +# 10536 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*dropped a LAN Failover command message. +desc=PIX $1 Failover Dropped a LAN packet +action=create fdr_$1; add fdr_$1 %t; add fdr_$1 %s; add fdr_$1 $0; report fdr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fdr_$1 + +# 10537 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*The primary and standby units are switching back +desc=PIX $1 Failover: primary and standby units are switching back +action=create fsw_$1; add fsw_$1 %t; add fsw_$1 %s; add fsw_$1 $0; report fsw_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsw_$1 + +# 10543 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Failover interface failed +desc=PIX $1 Failover LAN Interface is down! +action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 + +# messages from 106001 moved to top + +# 106011 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny inbound (No xlate).* +desc=PIX $1 Same-Side Traffic Attack +action=create sst_$1; add sst_$1 %t; add sst_$1 %s; add sst_$1 $0; report sst_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sst_$1 + +# 106016 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny IP spoof from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) on interface +desc=PIX $1 IP Spoof from $2 to $3 +action=create spf_$1; add spf_$1 %t; add spf_$1 %s; add spf_$1 $0; report spf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spf_$1 + +# 106017 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny IP due to Land Attack from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) +desc=PIX $1 IP LAND Attack +action=create lnd_$1; add lnd_$1 %t; add lnd_$1 %s; add lnd_$1 $0; report lnd_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lnd_$1 + +# 106020 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny IP teardrop fragment.*from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) +desc=PIX $1 Teardrop Attack +action=create tdr_$1; add tdr_$1 %t; add tdr_$1 %s; add tdr_$1 $0; report tdr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tdr_$1 + +# 106021 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny.*reverse path check from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+).* +desc=PIX $1 Reverse Path Check Attack from $2 to $3 +action=create rpc_$1; add rpc_$1 %t; add rpc_$1 %s; add rpc_$1 $0; report rpc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpc_$1 + +# 106022 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Deny.*connection spoof from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+).* +desc=PIX $1 Connection Spoof Attack from $2 to $3 +action=create spf_$1; add spf_$1 %t; add spf_$1 %s; add spf_$1 $0; report spf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spf_$1 + +# 106024 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Access rules memory exhausted +desc=PIX $1 Out of ACL Memory! +action=create ame_$1; add ame_$1 %t; add ame_$1 %s; add ame_$1 $0; report ame_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ame_$1 + +# 106025/6 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Failed to determine the security context for the packet:(\S+):(\d+.\d+.\d+.\d+) (\d+.\d+.\d+.\d+) (\d+) (\d+).* +desc=PIX $1 failed getting context for vlan $2 $3:$4 to $5:$6 +action=create ctx_$1; add ctx_$1 %t; add ctx_$1 %s; add ctx_$1 $0; report ctx_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ctx_$1 + +# 107001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*RIP auth failed from (\d+.\d+.\d+.\d+).* +desc=PIX $1 RIP Auth Attack from $2 +action=create rip_$1; add rip_$1 %t; add rip_$1 %s; add rip_$1 $0; report rip_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rip_$1 + +# 107002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*RIP pkt failed from (\d+.\d+.\d+.\d+).* +desc=PIX $1 Invalid RIP Packet from $2 +action=create rpk_$1; add rpk_$1 %t; add rpk_$1 %s; add rpk_$1 $0; report rpk_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpk_$1 + +# 109003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Auth from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+\/\d+) failed \(all servers failed\).* +desc=PIX $1 All AAA Failed from $2 to $3 +action=create aaa_$1; add aaa_$1 %t; add aaa_$1 %s; add aaa_$1 $0; report aaa_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete aaa_$1 + +# 109006/8 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(Authentication|Authorization) (failed|denied) for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Auth Guessing Attack by $2 from $3 to $4 +action=create brt_$1; add brt_$1 %t; add brt_$1 %s; add brt_$1 $0; report brt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete brt_$1 +window=10 +thresh=6 + +# 109010 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Auth from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) failed \(too many pending auths\).* +desc=PIX $1 Max Auths Reached for $2 to $3 +action=create mth_$1; add mth_$1 %t; add mth_$1 %s; add mth_$1 $0; report mth_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mth_$1 + +# 109017 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User at (\d+.\d+.\d+.\d+) exceeded auth proxy connection +desc=PIX $1 $2 has opened to many proxy conns +action=create pcn_$1; add pcn_$1 %t; add pcn_$1 %s; add pcn_$1 $0; report pcn_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pcn_$1 + +# 109024 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Authorization denied.*for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Authorization Denied HAMMER $2 from $3 to $4 +action=create uhm_$1; add uhm_$1 %t; add uhm_$1 %s; add uhm_$1 $0; report uhm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete uhm_$1 +window=10 +thresh=6 + +# 109025 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Authorization denied \(acl=.*\) for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) on interface.* +desc=PIX $1 Authorization Denied HAMMER $2 from $3 to $4 +action=create uhm_$1; add uhm_$1 %t; add uhm_$1 %s; add uhm_$1 $0; report uhm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete uhm_$1 +window=10 +thresh=6 + +# 111001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Begin configuration: (\d+.\d+.\d+.\d+) writing to (\S+) +desc=PIX $1 Config saved to $3 by $2 +action=create sav_$1; add sav_$1 %t; add sav_$1 %s; add sav_$1 $0; report sav_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sav_$1 + +# 111002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Begin configuration: (\d+.\d+.\d+.\d+) reading from (\S+) +desc=PIX $1 Config read from $3 by $2 +action=create sav_$1; add sav_$1 %t; add sav_$1 %s; add sav_$1 $0; report sav_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sav_$1 + +# 111003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(\d+.\d+.\d+.\d+) Erase configuration +desc=PIX $1 WRITE ERASE WAS ISSUED $2 +action=create ers_$1; add ers_$1 %t; add ers_$1 %s; add ers_$1 $0; report ers_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ers_$1 + +# 111004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*(\d+.\d+.\d+.\d+) end configuration: \[FAILED\] +desc=PIX $1 FAILED CONFIGURING $2 +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# 111008 +type=Single +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User \'(\S+)\' executed the command (.*) +desc=PIX $1 $2 executed: $3 +action=add CMD_REPORT $2 : $3 +#create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# FIXME -- Add syslog number +# FSWM Style +type=Single +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User \'(\S+)\' executed the \'(.*)\' command.* +desc=PIX $1 $2 executed: $3 +action=add CMD_REPORT $2 : $3 +#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + + +# 111008 +type=Single +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User (\S+) executed cmd:(.*) +desc=PIX $1 $2 executed: $3 +action=add CMD_REPORT $2 : $3 +#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 +#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# 113001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Unable to open AAA session. Session limit +desc=PIX $1 AAA Reached session limit +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# 113005 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*AAA user authentication Rejected: reason = (.*) server = .* User = (\S+).* +desc=PIX $1 IPSEC: User Auth Attack: $2 for $3 +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 +window=10 +thresh=6 + +# 113006 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User (\S+) locked out on exceeding number successive failed authentication attempts +desc=PIX $1 User Locked out: $2 +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# 113020 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Kerberos error : Clock skew with server (\d+.\d+.\d+.\d+).* +desc=PIX $1 User Locked out: $2 +action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 + +# Might be only 6.x +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Console Login from user at (\d+.\d+.\d+.\d+) +desc=PIX $1 Console Login from $2 +action=create con_$1; add con_$1 %t; add con_$1 %s; add con_$1 $0; report con_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete con_$1 + +# 112001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*clear (finished|complete)\. +desc=PIX $1 Clear Command Executed +action=create clr_$1; add clr_$1 %t; add clr_$1 %s; add clr_$1 $0; report clr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete clr_$1 + +# 199002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*[rR]eload command executed from.*(\d+.\d+.\d+.\d+) +desc=PIX $1 Reloaded by $2 +action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 + +# 199002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Orderly reload started at.*by (\S+). Reload.* +desc=PIX $1 Reloaded by $2 +action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 + +# 201002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+).*Too many.*connections on (static|xlate) (\d+.\d+.\d+.\d+) +desc=PIX $1 Max Embryonics to $3 (not attack) +action=create max_$1; add max_$1 %t; add max_$1 %s; add max_$1 $0; report max_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete max_$1 + +# 201003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Embryonic limit exceeded.*for (\d+.\d+.\d+.\d+\/\d+) \((\d+.\d+.\d+.\d+)\) (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Max Embryonics from $2 to $3 ($4) Attack +action=create emb_$1; add emb_$1 %t; add emb_$1 %s; add emb_$1 $0; report emb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete emb_$1 + +# 201008 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*The PIX is disallowing new connections. +desc=PIX $1 No longer allowing connections! +action=create stp_$1; add stp_$1 %t; add stp_$1 %s; add stp_$1 $0; report stp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete stp_$1 + +# 202001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Out of address translation slots! +desc=PIX $1 Out of NAT Slots +action=create nnt_$1; add nnt_$1 %t; add nnt_$1 %s; add nnt_$1 $0; report nnt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nnt_$1 + +# 209003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Fragment database limit of.*exceeded: src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* +desc=PIX $1 No room to assemble more frags from $2 to $3 +action=create frg_$1; add frg_$1 %t; add frg_$1 %s; add frg_$1 $0; report frg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete frg_$1 + +# 209004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Invalid IP fragment, size =.*exceeds maximum size =.*src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* +desc=PIX $1 Frag is invalid from $2 to $3 +action=create lrg_$1; add lrg_$1 %t; add lrg_$1 %s; add lrg_$1 $0; report lrg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lrg_$1 + +# 209005 +# FIXME -- Cisco log message doesnt match this +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Discard IP fragment set with more than.*elements:src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* +desc=PIX $1 To many frags from $2 to $3 +action=create _$1; add _$1 %t; add _$1 %s; add _$1 $0; report _$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete _$1 + +# 210002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU allocate block .* failed. +desc=PIX $1 Failover Block Alocation Failed +action=create fba_$1; add fba_$1 %t; add fba_$1 %s; add fba_$1 $0; report fba_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fba_$1 + +# 210005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU allocate connection failed +desc=PIX $1 Failover Connection Failed +action=create fcf_$1; add fcf_$1 %t; add fcf_$1 %s; add fcf_$1 $0; report fcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fcf_$1 + +# 210003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Unknown LU Object.* +desc=PIX $1 Failover: Unknown LU Object +action=create ulu_$1; add ulu_$1 %t; add ulu_$1 %s; add ulu_$1 $0; report ulu_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ulu_$1 + +# 210006 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU look NAT for (\d+.\d+.\d+.\d+) failed +desc=PIX $1 Failover NAT Sync failed for $2 +action=create fns_$1; add fns_$1 %t; add fns_$1 %s; add fns_$1 $0; report fns_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fns_$1 + +# 210007 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU allocate xlate failed +desc=PIX $1 Failover xlate Sync Failed +action=create fxs_$1; add fxs_$1 %t; add fxs_$1 %s; add fxs_$1 $0; report fxs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxs_$1 + +# 210008 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU no xlate for (\d+.\d+.\d+.\d+\/\d+) (\d+.\d+.\d+.\d+\/\d+) +desc=PIX $1 Failover xlate Sync Failure for $2 to $3 +action=create fxs_$1; add fxs_$1 %t; add fxs_$1 %s; add fxs_$1 $0; report fxs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxs_$1 + +# 210010 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU make UDP connection for (\d+.\d+.\d+.\d+:\d+) (\d+.\d+.\d+.\d+:\d+) failed +desc=PIX $1 Failover UDP Conn sync failure for $2 to $3 +action=create fus_$1; add fus_$1 %t; add fus_$1 %s; add fus_$1 $0; report fus_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fus_$1 + +# 210020 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU PAT port (\d+) reserve failed +desc=PIX $1 Failover PAT Sync for $2 failed +action=create fps_$1; add fps_$1 %t; add fps_$1 %s; add fps_$1 $0; report fps_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fps_$1 + +# 210021 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU create static xlate (\d+.\d+.\d+.\d+).*failed +desc=PIX $1 Failover Static xlate failed for $2 +action=create fxf_$1; add fxf_$1 %t; add fxf_$1 %s; add fxf_$1 $0; report fxf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxf_$1 + +# 210022 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*LU missed (\d+) updates +desc=PIX $1 Failover Sync failed for $2 updates +action=create fsf_$1; add fsf_$1 %t; add fsf_$1 %s; add fsf_$1 $0; report fsf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsf_$1 + +# 211001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Memory allocation Error +desc=PIX $1 Memory allocation Error! +action=create mae_$1; add mae_$1 %t; add mae_$1 %s; add mae_$1 $0; report mae_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mae_$1 + +# 211003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*CPU utilization for (\d+) seconds = (.*) +desc=PIX $1 CPU high ($2) for $3 secs +action=create cpu_$1; add cpu_$1 %t; add cpu_$1 %s; add cpu_$1 $0; report cpu_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cpu_$1 + +# 211003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Dropping SNMP request from (\d+.\d+.\d+.\d+\/\d+) to.*:(\d+.\d+.\d+.\d+\/\d+).* +desc=PIX $1 SNMP Attempt from $2 to $3 +action=create snp_$1; add snp_$1 %t; add snp_$1 %s; add snp_$1 $0; report snp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete snp_$1 + +# 213001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPTP control daemon socket io.*errno = (\d+) +desc=PIX $1 PPTP Error $2 +action=create ppt_$1; add ppt_$1 %t; add ppt_$1 %s; add ppt_$1 $0; report ppt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppt_$1 + +# 213002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPTP tunnel hashtable insert failed, peer = (\d+.\d+.\d+.\d+) +desc=PIX $1 PPTP hash table insert failed for $2 +action=create pht_$1; add pht_$1 %t; add pht_$1 %s; add pht_$1 $0; report pht_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pht_$1 + +# 213003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPP virtual interface (\S+) isn't opened. +desc=PIX $1 PPP Virtual Int $2 failed to close +action=create ppp_$1; add ppp_$1 %t; add ppp_$1 %s; add ppp_$1 $0; report ppp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppp_$1 + +# 213004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPP virtual interface (\S+) client ip allocation failed. +desc=PIX $1 PPP Virutal interface $2 failure (pool depleted) +action=create ppl_$1; add ppl_$1 %t; add ppl_$1 %s; add ppl_$1 $0; report ppl_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppl_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Denied Telnet login session from (\d+.\d+.\d+.\d+) on interface (int_name). +desc=PIX $1 Denid Telnet from $2 ($3) !! +action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Permitted Telnet login session from (\d+.\d+.\d+.\d+) +desc=PIX $1 Permitted Telnet from $2 ! +action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*telnet login session failed from (\d+.\d+.\d+.\d+).* +desc=PIX $1 Telnet login guessing attack +action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 + +# 308001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PIX console enable password incorrect for (num) tries \(from (\d+.\d+.\d+.\d+)\). +desc=PIX $1 Many Enable Password failures for $3 +action=create enb_$1; add enb_$1 %t; add enb_$1 %s; add enb_$1 $0; report enb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enb_$1 + +# 315011 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*SSH session from (\d+.\d+.\d+.\d+) on interface.*for user (\S+) disconnected by SSH server, reason:.* +desc=PIX $1 SSH Auth Attach from $2 ($3) +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 %s; add ssh_$1 $0; report ssh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ssh_$1 +window=10 +thresh=6 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Denied manager connection from (\d+.\d+.\d+.\d+). +desc=PIX $1 Denied Manager from $2 +action=create nmg_$1; add nmg_$1 %t; add nmg_$1 %s; add nmg_$1 $0; report nmg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nmg_$1 + +# FIXME -- Add log code FWSM +type=Single +continue=takenext +ptype=RegExp +pattern==^PIXLOG (\S+)\^ .*Denied SSH session from (\d+.\d+.\d+.\d+) on interface.* +desc=PIX $1 Denied SSH from $2 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 %s; add ssh_$1 $0; report ssh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ssh_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Permitted manager connection from (IP_addar). +desc=PIX $1 Allowed Manager from $2 +action=create ymg_$1; add ymg_$1 %t; add ymg_$1 %s; add ymg_$1 $0; report ymg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ymg_$1 + +# FIXME +# SET \d+.\d+.\d+.\d+ TO ! 128.135.0.x +#type=Single +#continue=takenext +#ptype=RegExp +#pattern=^PIXLOG (\S+)\^ .*Permitted SSH session from (\d+.\d+.\d+.\d+) on interface.*for user "user_id" +#desc=PIX $1 Permitted ssh $3 from $2 +#action=create fsh_$1; add fsh_$1 %t; add fsh_$1 %s; add fsh_$1 $0; report fsh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsh_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*SSH login session failed from (\d+.\d+.\d+.\d+) on \((num) attempts\) on interface.*by user "(\S+)" +desc=PIX $1 SSH $3 Failures from $2 by $4 +action=create lsh_$1; add lsh_$1 %t; add lsh_$1 %s; add lsh_$1 $0; report lsh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lsh_$1 + +# 402101 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*decaps: rec\'d IPSEC packet has invalid spi for destaddr=(\d+.\d+.\d+.\d+).* +desc=PIX $1 IPSEC: Invalid SPI in packet from $2 (possible attack) +action=create spi_$1; add spi_$1 %t; add spi_$1 %s; add spi_$1 $0; report spi_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spi_$1 + +# 402101 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*decapsulate: packet missing (.*), destadr=(\d+.\d+.\d+.\d+) +desc=PIX $1 IPSEC: Packet to $3 did not have type $2 (possible attack) +action=create itp_$1; add itp_$1 %t; add itp_$1 %s; add itp_$1 $0; report itp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete itp_$1 + +# 402103 +# FIXME -- This is messy +#type=Single +#continue=takenext +#ptype=RegExp +#pattern=^PIXLOG (\S+)\^ .*dentity doesn't match negotiated identity \((ip)\) dest_addr= (\d+.\d+.\d+.\d+), src_addr= (\d+.\d+.\d+.\d+), prot= protocol, \((ident)\) local=(\d+.\d+.\d+.\d+), remote=(\d+.\d+.\d+.\d+), local_proxy=(\d+.\d+.\d+.\d+/\d+.\d+.\d+.\d+/port/port), remote_proxy=(\d+.\d+.\d+.\d+/\d+.\d+.\d+.\d+/port/port) +#desc=PIX $1 IPSEC: Peer $2 is attempting to send other packets through us $3 $4 $5 $6 $7 +#action=create per_$1; add per_$1 %t; add per_$1 %s; add per_$1 $0; report per_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete per_$1 + +# 402115 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Received a packet from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) containing.*data instead of.*data. +desc=PIX $1 IPSEC: packet from $2 to $3 doesn't match negotiated proto +action=create ipx_$1; add ipx_$1 %t; add ipx_$1 %s; add ipx_$1 $0; report ipx_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ipx_$1 + +# 402115 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Received an.*packet.*from (\d+.\d+.\d+.\d+).*to (\d+.\d+.\d+.\d+).*The decapsulated inner packet doesn't match the negotiated policy in the SA +desc=PIX $1 IPSEC: packet from $2 to $3 is encapsulated with unexpected data. +action=create enc_$1; add enc_$1 %t; add enc_$1 %s; add enc_$1 $0; report enc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enc_$1 + +# 402118 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Received an.*packet.*from (\d+.\d+.\d+.\d+).*to (\d+.\d+.\d+.\d+) containing an illegal IP fragment.* +desc=PIX $1 IPSEC: packet from $2 to $3 has invalid fragment +action=create enc_$1; add enc_$1 %t; add enc_$1 %s; add enc_$1 $0; report enc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enc_$1 + +# 403103 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*PPP virtual interface max connections reached. +desc=PIX $1 PPP interfaces exhausted +action=create pie_$1; add pie_$1 %t; add pie_$1 %s; add pie_$1 $0; report pie_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pie_$1 + +# 403109 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Rec\'d packet not an PPTP packet. \(.*\) dest_addr= (\d+.\d+.\d+.\d+), src_addr= (\d+.\d+.\d+.\d+).* +desc=PIX $1 Spoofed PPTP Packet from $3 to $2 +action=create spp_$1; add spp_$1 %t; add spp_$1 %s; add spp_$1 $0; report spp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spp_$1 + +# 404101 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*ISAKMP: Failed to allocate address for client from pool (\S+) +desc=PIX $1 IPSEC: Failed to allocate addr from $2 +action=create faa_$1; add faa_$1 %t; add faa_$1 %s; add faa_$1 $0; report faa_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete faa_$1 + +# 405001 +#type=Single +#continue=takenext +#ptype=RegExp +#pattern=PIXLOG (\S+)\^ .*Received ARP.*collision from (\d+.\d+.\d+.\d+\/....\.....\.....) on.* +#desc=PIX $1 ARP Collision: $2 +#action=create mac_$1; add mac_$1 %t; add mac_$1 %s;add mac_$1 %s; add mac_$1 $0; report mac_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mac_$1 + +# +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Configuration replication failed for command (\S+) +desc=PIX $1 Failover replication command $2 failed +action=create rcf_$1; add rcf_$1 %t; add rcf_$1 %s; add rcf_$1 $0; report rcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rcf_$1 + +# 709001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*FO replication failed: cmd=(.*) returned=.* +desc=PIX $1 Failover: Command replication failed for Peer: $2 +action=create rcf_$1; add rcf_$1 %t; add rcf_$1 %s; add rcf_$1 $0; report rcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rcf_$1 + +# 316001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Denied new tunnel to (\d+.\d+.\d+.\d+). VPN peer limit.*exceeded.* +desc=PIX $1 VPN Peer limit exceeded for $2 +action=create plm_$1; add plm_$1 %t; add plm_$1 %s; add plm_$1 $0; report plm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete plm_$1 + +# 317003 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*IP routing table creation failure - (.*) +desc=PIX $1 Route table Error: $2 +action=create rte_$1; add rte_$1 %t; add rte_$1 %s; add rte_$1 $0; report rte_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rte_$1 + +# 317004 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*IP routing table limit warning +desc=PIX $1 Routing table limit reached +action=create rtl_$1; add rtl_$1 %t; add rtl_$1 %s; add rtl_$1 $0; report rtl_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rtl_$1 + +# 317005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*IP routing table limit exceeded - (.*), (\d+.\d+.\d+.\d+).* +desc=PIX $1 Route table limit breached by $3: $2 +action=create rtb_$1; add rtb_$1 %t; add rtb_$1 %s; add rtb_$1 $0; report rtb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rtb_$1 + +# 323005 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) can not be powered on completely +desc=PIX $1 Slot $2 will not power on +action=create slp_$1; add slp_$1 %t; add slp_$1 %s; add slp_$1 $0; report slp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete slp_$1 + +# 411002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Line protocol on interface (\S+) changed state to down +desc=PIX $1 Interface $2 is DOWN! +action=create lpd_$1; add ldp_$1 %t; add ldp_$1 %s; add lpd_$1 $0; report lpd_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lpd_$1 + +# 412002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Detected bridge table full while inserting MAC (....\.....\.....) on interface .* +desc=PIX $1 MAC Address table is FULL! +action=create brf_$1; add brf_$1 %t; add brf_$1 %s; add brf_$1 $0; report brf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete brf_$1 + +# 505001 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) is shutting down. Please.* +desc=PIX $1 Slot $2 is shutting down! +action=create sht_$1; add sht_$1 %t; add sht_$1 %s; add sht_$1 $0; report sht_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sht_$1 + +# 505002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) is reloading. Please.* +desc=PIX $1 Slot $2 is reloading! +action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 + +# 605004 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*Login denied from (.*) to (.*) for user "(\S+)" +desc=PIX $1 Auth Attack from $2 to $3 ($4) +action=create ath_$1; add ath_$1 %t; add ath_$1 %s; add ath_$1 $0; report ath_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ath_$1 +window=10 +thresh=6 + +# 611102 +type=SingleWithThreshold +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*User authentication failed: Uname: (\S+) +desc=PIX $1 Auth Attach from $2 +action=create ath_$1; add ath_$1 %t; add ath_$1 %s; add ath_$1 $0; report ath_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ath_$1 +window=10 +thresh=6 + +# 615002 +type=Single +continue=takenext +ptype=RegExp +pattern=^PIXLOG (\S+)\^ .*vlan number not available for firewall interface +desc=PIX $1 VLAN Error for FWSM +action=create vln_$1; add vln_$1 %t; add vln_$1 %s; add vln_$1 $0; report vln_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete vln_$1 + +# diff --git a/pix-security.sec b/pix-security.sec index fa99013..44b19f6 100644 --- a/pix-security.sec +++ b/pix-security.sec @@ -1,5 +1,10 @@ #################################################################### # SEC ruleset for Cisco PIX 6.x, 7.x +# +# Copyright (C) 2003-2009 Chris Sawall +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. #################################################################### # Process various events from PIX syslog output @@ -19,7 +24,7 @@ type=SingleWithThreshold ptype=RegExp pattern=\s*.*Deny\s+(\w+)\s+src.*:(.*)/.*:(.*)/(\b2\d\b).*$ desc=Unusual Failures:$1 $4/$2 -> $3 -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 window=10 thresh=10 @@ -31,7 +36,7 @@ continue=dontcont ptype=RegExp pattern=(212\.147\.14[12]\.) desc=Possible PHEL Trojan (1) -action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@domain.com; delete phel_$1 +action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@example.com; delete phel_$1 # ------------------------------------------------------------------ # Watch for firewall failovers @@ -50,7 +55,7 @@ continue=takenext ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Primary\).*$ desc=Secondary firewall for $1 - failure/reload -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 # Failure of secondary (standby) firewall while primary is active # Works for PIX 7.x @@ -62,7 +67,7 @@ continue=takenext ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Secondary\).*$ desc=Primary firewall for $1 - failure/reload -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 # Failure of secondary (active), primary assumes active # Works for PIX 7.x @@ -79,7 +84,7 @@ action=logonly ptype2=RegExp pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Primary\).*Peer state Standby Ready desc2=Secondary (was active) firewall ($1) has failed. Primary is now active. -action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 window=5 # Failure of primary (active), secondary assumes active @@ -97,7 +102,7 @@ action=logonly ptype2=RegExp pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Secondary\).*Peer state Standby Ready desc2=Primary firewall ($1) has failed. Secondary is now active. -action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 window=5 # ------------------------------------------------------------------ @@ -114,7 +119,7 @@ continue=dontcont ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX reload.*$ desc=$1 has been manually rebooted -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com ; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com ; delete ffo_$1 # Manual reload of PIX # Works for PIX 7.x @@ -126,7 +131,7 @@ continue=dontcont ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Orderly reload.*Reload reason:\s(\S+) desc=$1 has been manually rebooted, reason: $2 -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@domain.com; delete ffo_$1 +action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 # ------------------------------------------------------------------ # Watch for SSH logins/failures on firewalls @@ -152,7 +157,7 @@ continue=dontcont ptype=RegExp pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'.*to\s(\d+\.\d+\.\d+\.\d+)\/0.*SSH desc=Admin Auth to $1.$2 -> $3 from $4 -action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # Successful Admin SSH session # Works for PIX 7.x @@ -165,7 +170,7 @@ continue=dontcont ptype=RegExp pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'\sfrom\s(\d+\.\d+\.\d+\.\d+)\/0.*/22.*$ desc=Admin Auth to $1.$2 -> $3 from $4 -action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # Failed Admin SSH session # Works for PIX 6.x @@ -178,7 +183,7 @@ continue=takenext ptype=RegExp pattern=Authentication failed.*\'(\S+)\'.*SSH desc=Admin Auth FAILED -> $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # Failed Admin SSH session # Works for PIX 7.x @@ -191,7 +196,7 @@ continue=takenext ptype=RegExp pattern=Authentication failed.*\'(\S+)\'.*/22.*$ desc=Admin Auth FAILED -> $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # Normal SSH termination # Works for both PIX 6.x and 7.x @@ -202,7 +207,7 @@ type=Single ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*\"(\S+)\".*terminated normally desc=ADMIN END $1 -> $2 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # SSH session timeout or abnormal termination # Works for PIX 6.x @@ -214,7 +219,7 @@ type=Single ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*disconnected by SSH server desc=Firewall session END - timeout $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # ------------------------------------------------------------------ # Watch for firewall commands @@ -228,7 +233,7 @@ type=Single ptype=RegExp pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*write\sm.* desc=User wrote config to memory -> $1 -action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@domain.com; delete fwcmd_$1 +action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1 # Watch for HIGH CPU Utilization # Works for PIX 6.x @@ -237,5 +242,5 @@ type=Single ptype=RegExp pattern=PIX-.-211003 desc=HIGH CPU Utilization -action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@domain.com; delete fwcmd_$1 +action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1 diff --git a/pix-url.sec b/pix-url.sec index 306169a..a6e9879 100644 --- a/pix-url.sec +++ b/pix-url.sec @@ -1,5 +1,10 @@ #################################################################### # SEC ruleset for Monitoring Keywords +# +# Copyright (C) 2003-2009 Chris Sawall +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. #################################################################### # This particular ruleset was designed to monitor PIX syslog traffic @@ -41,7 +46,7 @@ type=Single ptype=PerlFunc pattern=sub {($_[0] =~ /($list)/) } desc=Inappropriate word in URL -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@domain.com; delete ssh_$1 +action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 # # Examples of "watch4badwords" and "watch4excludes" diff --git a/portscan.sec b/portscan.sec index 85303af..1b2effe 100644 --- a/portscan.sec +++ b/portscan.sec @@ -1,5 +1,10 @@ ################################################################ # Sample SEC ruleset for "PORTSCAN FROM ip1 TO ip2:port" events +# +# Copyright (C) 2003-2009 Risto Vaarandi +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. ################################################################ # process "PORTSCAN FROM ip1 TO ip2:port" events, and if a certain @@ -35,6 +40,6 @@ context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ continue=DontCont desc=$1 has scanned more than 10 destinations action=report HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ - mail -s 'Horizontal port sweep from $1 target port $3' root@localhost; \ + mail -s 'Horizontal port sweep from $1 target port $3' root@example.com; \ delete HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3; \ eval %o ( delete $portscans{"$1:$3"} ) diff --git a/sec.init b/sec.init index 7c06c9e..0c15c30 100755 --- a/sec.init +++ b/sec.init @@ -1,88 +1,102 @@ #!/bin/bash # -# sec This starts and stops SEC +# sec Start and stop SEC. # -# chkconfig: - 26 74 +# chkconfig: - 20 80 # description: Simple Event Correlator script to filter log file entries -# processname: /usr/bin/sec -# config: /etc/sysconfig/sec -# pidfile: /var/run/sec.pid -# -# Source function library. - . /etc/rc.d/init.d/functions +. /etc/rc.d/init.d/functions -# Default to a clean return value - RETVAL=0 +prog="sec" +exec="/usr/bin/sec" +lockfile="/var/lock/subsys/sec" -# Program we'll be executing - EXEC='/usr/bin/sec' - prog='sec' - - [ -f $EXEC ] || exit 0 - -# Source the config - [ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog - -# No options defined means that sec can't run - [ -z "$SEC_ARGS" ] && exit 0 - -# And away we go... +[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog start() { - for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do - echo -n $"Starting $prog instance "$(($n + 1))": " - daemon $EXEC ${SEC_ARGS[$n]} - RETVAL=$? - [ $RETVAL -ne 0 ] && return $RETVAL - done - touch /var/lock/subsys/$prog - return $RETVAL + [ -x $exec ] || exit 5 + for n in `seq 0 $((${#SEC_ARGS[*]} - 1))`; do + echo -n $"Starting $prog instance "$(($n + 1))": " + daemon $exec ${SEC_ARGS[$n]} + RETVAL=$? + echo + [ $RETVAL -ne 0 ] && return $RETVAL + done + touch $lockfile + return $RETVAL } stop() { - echo -n $"Stopping $prog: " - killproc $prog - RETVAL=$? - echo - [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog - return $RETVAL -} - -reload() { - echo -n $"Reloading configuration: " - killproc $prog -HUP - RETVAL=$? - echo - return $RETVAL + echo -n $"Stopping $prog: " + killproc $prog + RETVAL=$? + echo + [ $RETVAL -eq 0 ] && rm -f $lockfile + return $RETVAL } restart() { - stop - start + stop + start +} + +reload() { + echo -n $"Reloading $prog: " + killproc $prog -HUP + RETVAL=$? + echo + return $RETVAL +} + +force_reload() { + restart +} + +rh_status() { + status $prog +} + +rh_status_q() { + rh_status >/dev/null 2>&1 } dump() { - echo -n $"Dumping state in /tmp/sec.dump: " - killproc $prog -USR1 - RETVAL=$? - echo - return $RETVAL -} - -sec_status() { - status $prog + echo -n $"Dumping state of $prog in /tmp/sec.dump: " + killproc $prog -USR1 + RETVAL=$? + echo + return $RETVAL } case "$1" in - start|stop|reload|restart|dump) - $1 - ;; - status) - sec_status - ;; - *) - echo $"Usage: $0 {start|stop|reload|restart|dump|status}" - exit 2 + start) + start + ;; + stop) + stop + ;; + restart) + restart + ;; + condrestart|try-restart) + rh_status_q || exit 0 + restart + ;; + reload) + reload + ;; + force-reload) + force_reload + ;; + status) + rh_status + ;; + dump) + dump + ;; + *) + echo $"Usage: $0 {start|stop|restart|condrestart|try-restart|reload|force-reload|status|dump}" + exit 2 esac +exit $? diff --git a/sec.logrotate b/sec.logrotate index d536a75..87b02c3 100644 --- a/sec.logrotate +++ b/sec.logrotate @@ -3,6 +3,6 @@ notifempty sharedscripts postrotate - /sbin/service sec reload 2> /dev/null > /dev/null || true + /sbin/service sec reload >/dev/null 2>&1 || true endscript } diff --git a/sec.spec b/sec.spec index a4318c3..53b1db2 100644 --- a/sec.spec +++ b/sec.spec @@ -1,198 +1,121 @@ -# -# Specfile for SEC, the simple event correlator -# -# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169345 -# - Name: sec -Version: 2.4.1 -Release: 4%{?dist} -Summary: SEC (simple event correlator) - +Version: 2.5.2 +Release: 1%{?dist} +Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ -URL: http://www.estpak.ee/~risto/sec/ - -################################################################################ - +URL: http://simple-evcorr.sourceforge.net/ Source0: http://dl.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.sysconfig Source2: sec.init Source3: sec.logrotate - # Example files and configuration info -Source100: conf.README -Source101: http://www.estpak.ee/~risto/sec/examples/syslog-ng.txt -Source102: 001_init.sec -Source103: http://www.bleedingsnort.com/sec/amavisd.sec -Source104: http://www.bleedingsnort.com/sec/bsd-MONITOR.sec -Source105: http://www.bleedingsnort.com/sec/bsd-PHYSMOD.sec -Source106: http://www.bleedingsnort.com/sec/bsd-USERACT.sec -Source107: http://www.bleedingsnort.com/sec/clamav.sec -Source108: http://www.bleedingsnort.com/sec/cvs.sec -Source109: http://www.bleedingsnort.com/sec/dameware.sec -Source110: http://www.bleedingsnort.com/sec/dbi-example.sec -Source111: http://www.bleedingsnort.com/sec/general.sec -Source112: http://www.bleedingsnort.com/sec/hp-openview.sec -Source113: http://www.bleedingsnort.com/sec/labrea.sec -Source114: http://www.bleedingsnort.com/sec/mpd.sec -Source115: http://www.bleedingsnort.com/sec/pix-security.sec -Source116: http://www.bleedingsnort.com/sec/pix-url.sec -Source117: http://www.bleedingsnort.com/sec/portscan.sec -Source118: http://www.bleedingsnort.com/sec/snort.sec -Source119: http://www.bleedingsnort.com/sec/snortsam.sec -Source120: http://www.bleedingsnort.com/sec/ssh-brute.sec -Source121: http://www.bleedingsnort.com/sec/ssh.sec -Source122: http://www.bleedingsnort.com/sec/vtund.sec -Source123: http://www.bleedingsnort.com/sec/windows.sec +Source4: conf.README +Source5: http://simple-evcorr.sourceforge.net/rulesets/amavisd.sec +Source6: http://simple-evcorr.sourceforge.net/rulesets/bsd-MONITOR.sec +Source7: http://simple-evcorr.sourceforge.net/rulesets/bsd-PHYSMOD.sec +Source8: http://simple-evcorr.sourceforge.net/rulesets/bsd-USERACT.sec +Source9: http://simple-evcorr.sourceforge.net/rulesets/bsd-general.sec +Source10: http://simple-evcorr.sourceforge.net/rulesets/bsd-mpd.sec +Source11: http://simple-evcorr.sourceforge.net/rulesets/cisco-syslog.sec +Source12: http://simple-evcorr.sourceforge.net/rulesets/cvs.sec +Source13: http://simple-evcorr.sourceforge.net/rulesets/dameware.sec +Source14: http://simple-evcorr.sourceforge.net/rulesets/hp-openview.sec +Source15: http://simple-evcorr.sourceforge.net/rulesets/labrea.sec +Source16: http://simple-evcorr.sourceforge.net/rulesets/pix-general.sec +Source17: http://simple-evcorr.sourceforge.net/rulesets/pix-security.sec +Source18: http://simple-evcorr.sourceforge.net/rulesets/pix-url.sec +Source19: http://simple-evcorr.sourceforge.net/rulesets/portscan.sec +Source20: http://simple-evcorr.sourceforge.net/rulesets/snort.sec +Source21: http://simple-evcorr.sourceforge.net/rulesets/snortsam.sec +Source22: http://simple-evcorr.sourceforge.net/rulesets/ssh-brute.sec +Source23: http://simple-evcorr.sourceforge.net/rulesets/ssh.sec +Source24: http://simple-evcorr.sourceforge.net/rulesets/vtund.sec +Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec +BuildArch: noarch -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +# The init script uses arrays, so we need bash +Requires: bash +Requires: logrotate -BuildArch: noarch - -################################################################################ - -Requires(post): chkconfig +Requires(post): chkconfig Requires(postun): initscripts Requires(preun): initscripts, chkconfig -# The init script uses arrays, so we need bash -Requires: bash - -# Not required specifically by SEC, but our examples use it so we might as well -# create a requirement for logrotate. -Requires: logrotate - -# Some alternate names for the package that users might search for -Provides: simple-evcorr -Provides: sec.pl - -################################################################################ - %description -SEC is an open source and platform independent event correlation tool that -was designed to fill the gap between commercial event correlation systems and -homegrown solutions that usually comprise a few simple shell scripts. -SEC accepts input from regular files, named pipes, and standard input, and can -thus be employed as an event correlator for any application that is able to -write its output events to a file stream. - -################################################################################ +SEC is a simple event correlation tool that reads lines from files, named +pipes, or standard input, and matches the lines with regular expressions, +Perl subroutines, and other patterns for recognizing input events. +Events are then correlated according to the rules in configuration files, +producing output events by executing user-specified shell commands, by +writing messages to pipes or files, etc. %prep %setup -q -# Replace some tags in the config files - sed -i -e 's/@@NAME@@/%{name}/' \ - %{SOURCE1} \ - %{SOURCE2} \ - %{SOURCE3} - -# Fix the bindir in case a user wants it put in a different location - sed -i -e 's#/usr/bin/sec#%{_bindir}/sec#' \ - %{SOURCE2} - -################################################################################ +%build %install - -rm -rf $RPM_BUILD_ROOT - -# Create the directories we'll need - install -d -m 755 $RPM_BUILD_ROOT%{_initrddir} - install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/log - install -d -m 755 $RPM_BUILD_ROOT%{_localstatedir}/run - install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d - install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig - install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples - # Install SEC and its associated files - install -D -p -m 755 sec.pl $RPM_BUILD_ROOT%{_bindir}/sec - install -D -p -m 644 sec.pl.man $RPM_BUILD_ROOT%{_mandir}/man1/sec.1 - install -p -m 644 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/sec - install -p -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/sec - install -p -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_initrddir}/sec +install -D -m 0755 -p sec.pl %{buildroot}%{_bindir}/sec +install -D -m 0644 -p sec.pl.man %{buildroot}%{_mandir}/man1/sec.1 +install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/sec +install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec +install -D -m 0755 -p %{SOURCE2} %{buildroot}%{_initrddir}/sec # Install the example config files and readme - install -p -m 644 %{SOURCE100} \ - $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/README - install -p -m 644 %{SOURCE101} \ - $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/syslog-ng.sec - install -p -m 644 %{SOURCE102} \ - %{SOURCE103} \ - %{SOURCE104} \ - %{SOURCE105} \ - %{SOURCE106} \ - %{SOURCE107} \ - %{SOURCE108} \ - %{SOURCE109} \ - %{SOURCE110} \ - %{SOURCE111} \ - %{SOURCE112} \ - %{SOURCE113} \ - %{SOURCE114} \ - %{SOURCE115} \ - %{SOURCE116} \ - %{SOURCE117} \ - %{SOURCE118} \ - %{SOURCE119} \ - %{SOURCE120} \ - %{SOURCE121} \ - %{SOURCE122} \ - %{SOURCE123} \ - $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/examples/ +install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README +install -d -m 0755 examples +install -m 0644 -p %{SOURCE5} %{SOURCE6} %{SOURCE7} %{SOURCE8} \ + %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} \ + %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} \ + %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} \ + %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} \ + %{SOURCE25} examples/ -# Replace all "email.com" in sample scripts with an actual fake domain: example.com - grep -rl 'email.com' $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/ \ - | xargs sed -i -e 's/email.com/example.com/g' - -# Create ghost files so rpm doesn't complain about them being gone - touch $RPM_BUILD_ROOT%{_localstatedir}/log/sec - touch $RPM_BUILD_ROOT%{_localstatedir}/run/sec.pid - -################################################################################ +# Remove executable bits because these files get packed as docs +chmod 0644 contrib/convert.pl contrib/swatch2sec.pl %post - -if [ $1 = 1 ]; then - /sbin/chkconfig --add sec +if [ $1 -eq 1 ]; then + /sbin/chkconfig --add sec fi %preun - -if [ $1 = 0 ]; then - /sbin/service sec stop > /dev/null 2>&1 || : - /sbin/chkconfig --del sec +if [ $1 -eq 0 ]; then + /sbin/service sec stop >/dev/null 2>&1 + /sbin/chkconfig --del sec fi %postun - -if [ $1 = 1 ]; then - /sbin/service sec condrestart +if [ $1 -eq 1 ]; then + /sbin/service sec condrestart >/dev/null 2>&1 fi %clean - -rm -rf $RPM_BUILD_ROOT - -################################################################################ +rm -rf %{buildroot} %files - %defattr(-,root,root,-) -%doc ChangeLog COPYING README +%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples +%config(noreplace) %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/sysconfig/sec -%config(noreplace) %verify (not md5 size mtime) %{_sysconfdir}/logrotate.d/sec -%{_sysconfdir}/%{name} -%{_bindir}/sec +%config(noreplace) %{_sysconfdir}/logrotate.d/sec %{_initrddir}/sec -%{_mandir}/man1/* -%ghost %verify (not md5 size mtime) %{_localstatedir}/log/sec -%ghost %verify (not md5 size mtime) %{_localstatedir}/run/sec.pid - -################################################################################ +%{_bindir}/sec +%{_mandir}/man1/sec.1* %changelog +* Tue Sep 29 2009 Stefan Schulze Frielinghaus - 2.5.2-1 +- New upstream release +- SPEC file cleanup +- Init script cleanup +- Removed some examples because of licensing issues. Upstream has clarified + and changed most of the license tags to GPLv2. Additionally, upstream + will include the examples in the next release. +- Removed a provide statement since a period was in the name and no other + package required that special name. + * Sun Jul 26 2009 Fedora Release Engineering - 2.4.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild diff --git a/snort.sec b/snort.sec index 17e60d6..9cfe1ae 100644 --- a/snort.sec +++ b/snort.sec @@ -1,5 +1,10 @@ #################################################################### # Sample SEC ruleset for Snort IDS +# +# Copyright (C) 2003-2009 Risto Vaarandi +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. #################################################################### # ------------------------------------------------------------------ @@ -52,7 +57,8 @@ pattern=PRIORITY 1 INCIDENT FROM (\S+) TO \S+: .+ context=ATTACK_FROM_$1 continue=TakeNext desc=Priority 1 attack started from $1 -action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' +action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' \ + /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1' alerts@example.com # For every priority 1 incident, add an entry to the context by its IP; @@ -66,7 +72,7 @@ continue=TakeNext desc=Priority 1 incident from $1 to $2: $3 action=add ATTACK_FROM_$1 %t: %s; \ set ATTACK_FROM_$1 300 ( report ATTACK_FROM_$1 \ - /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@email.com ) + /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@example.com ) # ------------------------------------------------------------------ @@ -116,7 +122,7 @@ continue=TakeNext desc=Create activity contexts for $1 action=create ACTIVITY_LIST_FOR_$1_LIFETIME; \ create ACTIVITY_LIST_FOR_$1 7200 ( report ACTIVITY_LIST_FOR_$1 \ - /usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@email.com; \ + /usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@example.com; \ delete ACTIVITY_LIST_FOR_$1_LIFETIME ) @@ -142,7 +148,7 @@ type=Calendar time=0 12 * * * desc=Sending alert report... action=report ALERT_REPORT \ - /usr/bin/mail -s 'SNORT: Hourly alert report' alerts@email.com; \ + /usr/bin/mail -s 'SNORT: Hourly alert report' alerts@example.com; \ delete ALERT_REPORT @@ -152,6 +158,6 @@ type=Calendar time=0 9 * * * desc=Sending portscan report... action=report PORTSCAN_REPORT \ - /usr/bin/mail -s 'SNORT: daily portscan report' alerts@email.com; \ + /usr/bin/mail -s 'SNORT: daily portscan report' alerts@example.com; \ delete PORTSCAN_REPORT diff --git a/snortsam.sec b/snortsam.sec index b0a687c..05aa074 100644 --- a/snortsam.sec +++ b/snortsam.sec @@ -1,10 +1,17 @@ - +############################################################################# +# Snort SAM events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=single ptype=regexp pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Error: Could not bind socket. desc = $0 -action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@yourdomain.com +action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@example.com type=single @@ -24,7 +31,7 @@ action=add SNORTSAM_REPORT $1 Extending Block for $3 for $4 #ptype=regexp #pattern=([A-Za-z0-9._-]+)snortsam\[([0-9]+)\]: [*], [:0-9]+, -, ipf, (.*) Failed #desc = Snortsam ipf error -#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@yourdomain.com +#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@example.com ##action=add SNORTSAM_REPORT ERROR $1 IPF Command Failure: $2 @@ -52,13 +59,13 @@ type=single ptype=regexp pattern=([A-Za-z0-9._-]+) root: (.*) ipf, Error: Command (.*) Failed desc = $0 -action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@yourdomain.com +action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@example.com type=single ptype=regexp pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Snortsam Station .* using wrong password, trying to resync. desc = $0 -action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@yourdomain.com +action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@example.com #Send hourly snortsam report @@ -66,5 +73,5 @@ type=Calendar time=0 * * * * desc=Sending snortsam report... action=report SNORTSAM_REPORT \ - /usr/bin/mail -s 'SNORTSAM report' alerts@yourdomain.com; \ + /usr/bin/mail -s 'SNORTSAM report' alerts@example.com; \ delete SNORTSAM_REPORT diff --git a/sources b/sources index c2c00db..506f351 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -f233b3acf7cebdb573f4ff1f441866c3 sec-2.4.1.tar.gz +0e5e3c2e4e3ef6c21fc32a809c6263bb sec-2.5.2.tar.gz diff --git a/ssh-brute.sec b/ssh-brute.sec index 884eec9..f993507 100644 --- a/ssh-brute.sec +++ b/ssh-brute.sec @@ -1,4 +1,10 @@ ################## ssh brute force attack blocker +# Copyright (C) 2003-2009 Mark Bergman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +################## +# # This sec ruleset monitors syslog messages for indications that an ssh brute-force # login attack is underway. The trigger is an ssh login failure. # @@ -15,10 +21,6 @@ # 2 hours. # # Vulnerabilities of this ruleset are: -# DoS attack: if the attacker is aware of this ruleset, they could -# spoof a series of victim IP addresses (for example, the -# AOL proxy address), thus causing the server running sec -# to deny service to the victim. # # persistent firewall rules: # if the sec daemon crashes or is restarted, any existing rules @@ -31,7 +33,7 @@ # window2=7200 # sliding window (2 hours) for the second event match # thresh2=0 ############### -# RCSversion="$Header: /home/fedora/jkeating/pkgs/rpms/sec/EL-6/ssh-brute.sec,v 1.1 2006/09/01 20:54:01 xris Exp $" +# RCSversion="$Header: /home/fedora/jkeating/pkgs/rpms/sec/EL-6/ssh-brute.sec,v 1.2 2009/10/03 07:52:15 stefansf Exp $" # # Representative log file entries: # Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp diff --git a/ssh.sec b/ssh.sec index b718248..d9704e9 100644 --- a/ssh.sec +++ b/ssh.sec @@ -1,6 +1,13 @@ -# a ruleset to accumulate errors from a parent and child sshd process +########################################################################### +# SEC ruleset to accumulate errors from a parent and child sshd process # into a single context. This allows reporting of the authenticated # user information with the error's generated by the child sshd process. +# +# Copyright (C) 2003-2009 John P. Rouillard +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +########################################################################### # note handling of deferred reporting until after tie events received # is still in flux. My old rules hanlded it by resubmitting all the @@ -38,7 +45,7 @@ action=create EVENT_PROCESSED #ptype=regexp #pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Connection from ([0-9.]+) port [0-9]+ #action=pipe session_log_$1_$2 \ -# /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@email.com +# /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@example.com #desc2=Link parent and child contexts #ptype2=regexp #pattern2=$1 [A-z0-9]+\[[0-9]+\]: \[[^]]+\] SSHD child process +([0-9]+) spawned by $2 @@ -86,7 +93,7 @@ desc=Report immediate on request. ptype=regexp pattern=^sshd: Report (.*) if needed$ context = session_log_report_$1 -action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@email.com ;\ +action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@example.com ;\ delete session_log_report_$1 type=suppress @@ -144,7 +151,7 @@ pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel context = $3 < 1025 && tie_event_received_$1_$2 action = add session_log_$1_$2 $0 ; \ report session_log_report_$1_$2 \ - /usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@email.com + /usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@example.com # end immediate rules here @@ -178,7 +185,7 @@ pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: A context = ssh_port_forward_errors_$1_$2 desc = send report on ssh forward errors if pass threshold (bind) action = report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh port forward errors host $1" alerts@email.com; \ + /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com; \ delete ssh_port_forward_errors_$1_$2 thresh=5 window=600 @@ -211,7 +218,7 @@ pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel context = ssh_channel_setup_errors_$1_$2 desc = send report on ssh channel setup errors action = report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh port forward errors host $1" alerts@email.com ; \ + /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com ; \ delete ssh_channel_setup_errors_$1_$2 thresh=5 window=600 @@ -234,7 +241,7 @@ pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: desc = create context to report ssh errors for host $1 pid $2 in 5 minutes context = ! session_log_5min_timer_$1_$2 action = create session_log_5min_timer_$1_$2 300 report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@email.com + /usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@example.com type=single continue = dontcont diff --git a/syslog-ng.txt b/syslog-ng.txt deleted file mode 100644 index 8bc90fc..0000000 --- a/syslog-ng.txt +++ /dev/null @@ -1,95 +0,0 @@ -################################################################ -# SEC ruleset for syslog-ng (contributed by Peter Straka) -################################################################ -#date host proces[pid]: [ID number facility.level] txt - -################################################################ -# internal -################################################################ -# setings parameters for next use -# -# %A,%B,%C,%D = parameters -# %F = output file for write -# %E = email list -# %M = mail program -################################################################ - -#rule beno#1 -type=Single -ptype=RegExp -pattern=(SEC_STARTUP|SEC_RESTART|SEC_SHUTDOWN) -context=SEC_INTERNAL_EVENT -desc=SEC internal -action=shellcmd /bin/echo -- %t %s $0;\ - assign %F /tmp/sec.out;\ - assign %E root@localhost;\ - assign %M /bin/mail -s "SEC production event";\ - add OUT %t "starting";\ - -################################################################ -# statistics -################################################################ - -#rule beno#2 -type=Single -continue=TakeNext -ptype=RegExp -pattern=\s(\S+)\s(\S+)\[\d+\]\:\s\[ID \d+ (\S+)\.(\S+)\]\s -desc=log level and facility counter + host and proces counter -action= assign %A $1;\ - assign %B $2;\ - assign %C $3;\ - assign %D $4;\ - eval %Z ($host{"%A"}++; $proces{"%B"}++; $facility{"%C"}++; $level{"%D"}++;); - -#rule beno#3 -#write statistics and null counters every hour -type=Calendar -time=0 * * * * -desc=log level and facility counter + host and proces counter -action=eval %Z (\ - my @ret; \ - push(@ret,"*******************************\n***** LEVEL:\n");\ - foreach $x (keys %level) {push(@ret,sprintf "%%s=%d\n",$x,$level{$x}) if $level{$x}; $level{$x}=0}; \ - push(@ret,"\n***** FACILITY:\n");\ - foreach $x (keys %facility) {push(@ret,sprintf "%%s=%d\n",$x,$facility{$x}) if $facility{$x}; $facility{$x}=0}; \ - push(@ret,"\n***** HOSTS:\n");\ - foreach $x (keys %host) {push(@ret,sprintf "%%s=%d\n",$x,$host{$x}) if $host{$x}; $host{$x}=0}; \ - push(@ret,"\n***** PROCES:\n");\ - foreach $x (keys %proces) {push(@ret,sprintf "%%s=%d\n",$x,$proces{$x}) if $proces{$x}; $proces{$x}=0}; \ -push(@ret,"\n********************************************************\n");\ - return "@ret"); \ - write %F %t %Z; \ - add STAT %Z; \ - report STAT %M %E; \ - delete STAT ; - -################################################################ -# hourly statistics -################################################################ - -#rule beno#4 -type=Single -continue=TakeNext -ptype=RegExp -pattern=\S+\s+\d+\s+(\d+)\:\d+\:\d+\s -desc=hourly counter -action=assign %A H$1;\ - eval %Z ($hour{%A}++;); - -#rule beno#5 -#write statistics and null counters at midnight -type=Calendar -time=25 16 * * * -desc=hourly counter -action=eval %Z (\ - my @ret; \ - push(@ret,"*******************************\n");\ - foreach $x (keys %hour) {push(@ret,sprintf "%%s:00=%d\n",$x,$hour{$x});$hour{$x}=0}; \ -push(@ret,"\n********************************************************\n");\ - return "@ret"); \ - write %F %t %Z; \ - add HOUR_STAT %Z; \ - report HOUR_STAT %M %E; \ - delete HOUR_STAT - diff --git a/vtund.sec b/vtund.sec index 3eb7ef0..1bc167f 100644 --- a/vtund.sec +++ b/vtund.sec @@ -1,4 +1,11 @@ -#VTUN Events +############################################################################# +# VTUN events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=Single ptype=RegExp @@ -58,14 +65,3 @@ pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (/S+) closed desc=$0 action=add GENERAL_REPORT %t: VTUN Session $2 Closed on $1 - - -#Send 12 hours vtun report - -type=Calendar -time=0 0,12 * * * -desc=Sending vtun report... -action=report VTUN_REPORT \ - /usr/bin/mail -s 'VTUN: VTUN Report' alerts@yourdomain.com; \ - delete VTUN_REPORT0 - diff --git a/windows.sec b/windows.sec index 34110e8..9e63e3c 100644 --- a/windows.sec +++ b/windows.sec @@ -1,4 +1,11 @@ -#Windows events +############################################################################# +# Windows events +# +# Copyright (C) 2003-2009 Matt Jonkman +# This is free software. You may redistribute copies of it under the terms of +# the GNU General Public License version 2. +# There is NO WARRANTY, to the extent permitted by law. +############################################################################# type=Single ptype=RegExp @@ -17,21 +24,21 @@ type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Locked Out: Target Account Name: (\S+) .* desc=$0 -action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@yourdomain.com +action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@example.com type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Changed: (/S+)\. .* desc=$0 -action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@yourdomain.com +action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@example.com type=Single ptype=RegExp pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+NetBT: N\/A: A duplicate name has been detected on the TCP network\. .* desc=$0 -action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@yourdomain.com +action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@example.com From 98bdf17edcf1b2919346135fb7ed608561ab61c6 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Fri, 6 Nov 2009 09:15:04 +0000 Subject: [PATCH 08/32] Fixed URL of Source0 --- sec.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 53b1db2..87d6eaf 100644 --- a/sec.spec +++ b/sec.spec @@ -5,7 +5,7 @@ Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ URL: http://simple-evcorr.sourceforge.net/ -Source0: http://dl.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz +Source0: http://prdownloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.sysconfig Source2: sec.init Source3: sec.logrotate From 82b7275118c85ba41ac9dd031d4eb651c50bd33c Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 7 Nov 2009 09:35:19 +0000 Subject: [PATCH 09/32] Fixed Source0 URL. --- sec.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sec.spec b/sec.spec index 87d6eaf..01784de 100644 --- a/sec.spec +++ b/sec.spec @@ -5,7 +5,7 @@ Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ URL: http://simple-evcorr.sourceforge.net/ -Source0: http://prdownloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz +Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.sysconfig Source2: sec.init Source3: sec.logrotate From 53c333e40de5cb06a1b780769c5f951b7906f1e2 Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Thu, 26 Nov 2009 01:38:23 +0000 Subject: [PATCH 10/32] Fix typo that causes a failure to update the common directory. (releng #2781) --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index a45a953..4f1bdb0 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,10 @@ # Makefile for source rpm: sec -# $Id$ +# $Id: Makefile,v 1.1 2006/09/01 20:49:05 xris Exp $ NAME := sec SPECFILE = $(firstword $(wildcard *.spec)) define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done +for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done endef MAKEFILE_COMMON := $(shell $(find-makefile-common)) From 862adf2d767032b52895ffdfa2a7376019a2f354 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Tue, 22 Dec 2009 09:25:59 +0000 Subject: [PATCH 11/32] New upstream release --- sec.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sec.spec b/sec.spec index 01784de..02efadb 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.5.2 -Release: 1%{?dist} +Version: 2.5.3 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Mon Dec 21 2009 Stefan Schulze Frielinghaus - 2.5.3-0 +- New upstream release + * Tue Sep 29 2009 Stefan Schulze Frielinghaus - 2.5.2-1 - New upstream release - SPEC file cleanup From 674b400365ec8599f3e2209f6d50030816e8efeb Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Tue, 22 Dec 2009 09:49:39 +0000 Subject: [PATCH 12/32] Adding source file --- .cvsignore | 2 +- import.log | 1 + sources | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.cvsignore b/.cvsignore index d14f9ac..ec684c7 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1 +1 @@ -sec-2.5.2.tar.gz +sec-2.5.3.tar.gz diff --git a/import.log b/import.log index 2fdc0a3..0631537 100644 --- a/import.log +++ b/import.log @@ -1 +1,2 @@ sec-2_5_2-1_fc11:F-12:sec-2.5.2-1.fc11.src.rpm:1254556293 +sec-2_5_3-0_fc12:F-12:sec-2.5.3-0.fc12.src.rpm:1261475339 diff --git a/sources b/sources index 506f351..9c12a8e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -0e5e3c2e4e3ef6c21fc32a809c6263bb sec-2.5.2.tar.gz +11bb84273daf24d265a96624ab6413ca sec-2.5.3.tar.gz From 020d7af225811dfeffcdebba61093926e7064dc0 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Sat, 8 May 2010 02:23:07 +0000 Subject: [PATCH 13/32] Initialize branch EL-6 for sec --- branch | 1 + 1 file changed, 1 insertion(+) create mode 100644 branch diff --git a/branch b/branch new file mode 100644 index 0000000..46381b9 --- /dev/null +++ b/branch @@ -0,0 +1 @@ +EL-6 From a0eae6a36ca43ec5b5b5914fe0b01e271237d9db Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 29 Jul 2010 12:19:50 +0000 Subject: [PATCH 14/32] dist-git conversion --- .cvsignore => .gitignore | 0 Makefile | 21 --------------------- branch | 1 - import.log | 2 -- 4 files changed, 24 deletions(-) rename .cvsignore => .gitignore (100%) delete mode 100644 Makefile delete mode 100644 branch delete mode 100644 import.log diff --git a/.cvsignore b/.gitignore similarity index 100% rename from .cvsignore rename to .gitignore diff --git a/Makefile b/Makefile deleted file mode 100644 index 4f1bdb0..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: sec -# $Id: Makefile,v 1.1 2006/09/01 20:49:05 xris Exp $ -NAME := sec -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/branch b/branch deleted file mode 100644 index 46381b9..0000000 --- a/branch +++ /dev/null @@ -1 +0,0 @@ -EL-6 diff --git a/import.log b/import.log deleted file mode 100644 index 0631537..0000000 --- a/import.log +++ /dev/null @@ -1,2 +0,0 @@ -sec-2_5_2-1_fc11:F-12:sec-2.5.2-1.fc11.src.rpm:1254556293 -sec-2_5_3-0_fc12:F-12:sec-2.5.3-0.fc12.src.rpm:1261475339 From 992377dd496a8f9a4ed39bb7cd5d0f7bead1db74 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Mon, 18 Mar 2013 09:22:58 +0100 Subject: [PATCH 15/32] New upstream release --- .gitignore | 1 + sec.spec | 9 ++++++--- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ec684c7..e4dde0e 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ sec-2.5.3.tar.gz +/sec-2.7.1.tar.gz diff --git a/sec.spec b/sec.spec index 02efadb..57348f2 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.5.3 +Version: 2.7.1 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -57,8 +57,8 @@ writing messages to pipes or files, etc. %install # Install SEC and its associated files -install -D -m 0755 -p sec.pl %{buildroot}%{_bindir}/sec -install -D -m 0644 -p sec.pl.man %{buildroot}%{_mandir}/man1/sec.1 +install -D -m 0755 -p sec %{buildroot}%{_bindir}/sec +install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1 install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/sec install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec install -D -m 0755 -p %{SOURCE2} %{buildroot}%{_initrddir}/sec @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Mon Mar 18 2013 Stefan Schulze Frielinghaus - 2.7.1-0 +- New upstream release + * Mon Dec 21 2009 Stefan Schulze Frielinghaus - 2.5.3-0 - New upstream release diff --git a/sources b/sources index 9c12a8e..4e0d40d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -11bb84273daf24d265a96624ab6413ca sec-2.5.3.tar.gz +e5dde148b8551f9399e6d63f8899558b sec-2.7.1.tar.gz From 84a1c51daf13956cc43a8238a937c4e92e26170d Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Mon, 15 Apr 2013 09:27:06 +0200 Subject: [PATCH 16/32] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index e4dde0e..023f2db 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ sec-2.5.3.tar.gz /sec-2.7.1.tar.gz +/sec-2.7.2.tar.gz diff --git a/sec.spec b/sec.spec index 57348f2..566b6dc 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.1 +Version: 2.7.2 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Mon Apr 15 2013 Stefan Schulze Frielinghaus - 2.7.2-0 +- New upstream release + * Mon Mar 18 2013 Stefan Schulze Frielinghaus - 2.7.1-0 - New upstream release diff --git a/sources b/sources index 4e0d40d..6a9778d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -e5dde148b8551f9399e6d63f8899558b sec-2.7.1.tar.gz +97596c53487c31cb96f28ae3e964d6fa sec-2.7.2.tar.gz From 6149f7171bbd5f68eb398a1f4b38e979dfce396c Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 30 Jun 2013 09:12:49 +0200 Subject: [PATCH 17/32] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 023f2db..bac682f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ sec-2.5.3.tar.gz /sec-2.7.1.tar.gz /sec-2.7.2.tar.gz +/sec-2.7.4.tar.gz diff --git a/sec.spec b/sec.spec index 566b6dc..7a49fbf 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.2 +Version: 2.7.4 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Sun Jun 30 2013 Stefan Schulze Frielinghaus - 2.7.4-0 +- New upstream release + * Mon Apr 15 2013 Stefan Schulze Frielinghaus - 2.7.2-0 - New upstream release diff --git a/sources b/sources index 6a9778d..33917a2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -97596c53487c31cb96f28ae3e964d6fa sec-2.7.2.tar.gz +7006666a47ca5e6f0a405d16fa3024eb sec-2.7.4.tar.gz From 13178e5581d2e588c2453403b3c01d9c8baf1312 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Fri, 17 Jan 2014 14:43:03 +0100 Subject: [PATCH 18/32] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index bac682f..c7ef5ab 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ sec-2.5.3.tar.gz /sec-2.7.1.tar.gz /sec-2.7.2.tar.gz /sec-2.7.4.tar.gz +/sec-2.7.5.tar.gz diff --git a/sec.spec b/sec.spec index 7a49fbf..6f31fa5 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.4 +Version: 2.7.5 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Fri Jan 17 2014 Stefan Schulze Frielinghaus - 2.7.5-0 +- New upstream release + * Sun Jun 30 2013 Stefan Schulze Frielinghaus - 2.7.4-0 - New upstream release diff --git a/sources b/sources index 33917a2..3e68cea 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -7006666a47ca5e6f0a405d16fa3024eb sec-2.7.4.tar.gz +071371ce1c98e3c397601780d3a5f3c5 sec-2.7.5.tar.gz From d4f7aba4ba8ff4a3d1337cbb2cba3c619e646a64 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 18 Feb 2015 15:22:15 +0100 Subject: [PATCH 19/32] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index c7ef5ab..9cdb694 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ sec-2.5.3.tar.gz /sec-2.7.2.tar.gz /sec-2.7.4.tar.gz /sec-2.7.5.tar.gz +/sec-2.7.7.tar.gz diff --git a/sec.spec b/sec.spec index 6f31fa5..54f074d 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.5 +Version: 2.7.7 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Wed Feb 18 2015 Stefan Schulze Frielinghaus - 2.7.7-0 +- New upstream release + * Fri Jan 17 2014 Stefan Schulze Frielinghaus - 2.7.5-0 - New upstream release diff --git a/sources b/sources index 3e68cea..ec9aeb6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -071371ce1c98e3c397601780d3a5f3c5 sec-2.7.5.tar.gz +994bc5e0f5a5046128829ed52f6da8e3 sec-2.7.7.tar.gz From 345fb5524e9e2acad7400975b9b1a116e470befd Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 14 Oct 2015 21:05:07 +0200 Subject: [PATCH 20/32] Rotating logfiles --- sec.init | 8 ++++++++ sec.logrotate | 2 +- sec.spec | 5 ++++- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/sec.init b/sec.init index 0c15c30..833ea0c 100755 --- a/sec.init +++ b/sec.init @@ -48,6 +48,14 @@ reload() { return $RETVAL } +rotate() { + echo -n $"Rotating $prog: " + killproc $prog -USR2 + RETVAL=$? + echo + return $RETVAL +} + force_reload() { restart } diff --git a/sec.logrotate b/sec.logrotate index 87b02c3..5be73aa 100644 --- a/sec.logrotate +++ b/sec.logrotate @@ -3,6 +3,6 @@ notifempty sharedscripts postrotate - /sbin/service sec reload >/dev/null 2>&1 || true + /sbin/service sec rotate >/dev/null 2>&1 || true endscript } diff --git a/sec.spec b/sec.spec index 54f074d..d9d65da 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.7 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Wed Oct 14 2015 Stefan Schulze Frielinghaus - 2.7.7-1 +- While rotating logfiles do not do a full restart of the sec instance + * Wed Feb 18 2015 Stefan Schulze Frielinghaus - 2.7.7-0 - New upstream release From 5578ba00cacd4bcca5c9f601d2d52ab715b94c76 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 25 Oct 2015 12:36:47 +0100 Subject: [PATCH 21/32] update init script: stop rule --- sec.init | 2 +- sec.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/sec.init b/sec.init index 833ea0c..76eb009 100755 --- a/sec.init +++ b/sec.init @@ -28,7 +28,7 @@ start() { stop() { echo -n $"Stopping $prog: " - killproc $prog + killproc -TERM $prog RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f $lockfile diff --git a/sec.spec b/sec.spec index d9d65da..537395c 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.7 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Sun Oct 25 2015 Stefan Schulze Frielinghaus - 2.7.7-2 +- Update init script in order to send SIGTERM instead of SIGKILL for stop rule + * Wed Oct 14 2015 Stefan Schulze Frielinghaus - 2.7.7-1 - While rotating logfiles do not do a full restart of the sec instance From a1c6b011d6ffa5d8039308d7616073a86f2c0e70 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 11 Nov 2015 08:03:10 +0100 Subject: [PATCH 22/32] Add an optional timeout to the init script rule stop --- sec.init | 6 +++++- sec.spec | 5 ++++- sec.sysconfig | 4 ++++ 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/sec.init b/sec.init index 76eb009..8699ed7 100755 --- a/sec.init +++ b/sec.init @@ -28,7 +28,11 @@ start() { stop() { echo -n $"Stopping $prog: " - killproc -TERM $prog + if [ -z "$SHUTDOWN_TIMELIMIT" ]; then + killproc $prog + else + killproc -d $SHUTDOWN_TIMELIMIT $prog + fi RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f $lockfile diff --git a/sec.spec b/sec.spec index 537395c..9f7e1cb 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.7 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Wed Nov 11 2015 Stefan Schulze Frielinghaus - 2.7.7-3 +- Add an optional timeout to the init script rule stop + * Sun Oct 25 2015 Stefan Schulze Frielinghaus - 2.7.7-2 - Update init script in order to send SIGTERM instead of SIGKILL for stop rule diff --git a/sec.sysconfig b/sec.sysconfig index db96875..9c7ff58 100644 --- a/sec.sysconfig +++ b/sec.sysconfig @@ -23,3 +23,7 @@ # # SEC_ARGS[1]="-detach -conf=/etc/sec/mail/*.sec -input=/var/log/messages -log=/var/log/sec -intevents -pid=/var/run/sec.mail.pid" # +# Time limit (in seconds) to wait for SEC to shutdown. +# Default value defined in /etc/init.d/functions (usually 3 seconds) +# +# SHUTDOWN_TIMELIMIT=60 From 523a85fa09dd8f559821364ae3f09b69561442b5 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 6 Dec 2015 10:26:43 +0100 Subject: [PATCH 23/32] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 9cdb694..2c05c1e 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ sec-2.5.3.tar.gz /sec-2.7.4.tar.gz /sec-2.7.5.tar.gz /sec-2.7.7.tar.gz +/sec-2.7.8.tar.gz diff --git a/sec.spec b/sec.spec index 9f7e1cb..741e8b8 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.7.7 -Release: 3%{?dist} +Version: 2.7.8 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Sun Dec 6 2015 Stefan Schulze Frielinghaus - 2.7.8-0 +- New upstream release + * Wed Nov 11 2015 Stefan Schulze Frielinghaus - 2.7.7-3 - Add an optional timeout to the init script rule stop diff --git a/sources b/sources index ec9aeb6..453e2e5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -994bc5e0f5a5046128829ed52f6da8e3 sec-2.7.7.tar.gz +cb0a840b603fb7d32d16b91bd5f23be7 sec-2.7.8.tar.gz From 9aadc659dcfbf8897b185a43a3da3f11b1bb46cc Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 3 Feb 2016 20:01:33 +0100 Subject: [PATCH 24/32] Init script supports log rotation now --- sec.init | 5 ++++- sec.spec | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/sec.init b/sec.init index 8699ed7..bf6bfb9 100755 --- a/sec.init +++ b/sec.init @@ -100,6 +100,9 @@ case "$1" in force-reload) force_reload ;; + rotate) + rotate + ;; status) rh_status ;; @@ -107,7 +110,7 @@ case "$1" in dump ;; *) - echo $"Usage: $0 {start|stop|restart|condrestart|try-restart|reload|force-reload|status|dump}" + echo $"Usage: $0 {start|stop|restart|condrestart|try-restart|reload|force-reload|rotate|status|dump}" exit 2 esac diff --git a/sec.spec b/sec.spec index 741e8b8..376a970 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec Version: 2.7.8 -Release: 0%{?dist} +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Wed Feb 3 2016 Stefan Schulze Frielinghaus - 2.7.8-1 +- Init script supports log rotation now + * Sun Dec 6 2015 Stefan Schulze Frielinghaus - 2.7.8-0 - New upstream release From 5f134de507fcdf3060be62c9c0083b61ed95b748 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 2 Apr 2016 18:27:38 +0200 Subject: [PATCH 25/32] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2c05c1e..979c84c 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ sec-2.5.3.tar.gz /sec-2.7.5.tar.gz /sec-2.7.7.tar.gz /sec-2.7.8.tar.gz +/sec-2.7.9.tar.gz diff --git a/sec.spec b/sec.spec index 376a970..726d0f5 100644 --- a/sec.spec +++ b/sec.spec @@ -1,6 +1,6 @@ Name: sec -Version: 2.7.8 -Release: 1%{?dist} +Version: 2.7.9 +Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Sat Apr 2 2016 Stefan Schulze Frielinghaus - 2.7.9-0 +- New upstream release + * Wed Feb 3 2016 Stefan Schulze Frielinghaus - 2.7.8-1 - Init script supports log rotation now diff --git a/sources b/sources index 453e2e5..ab9e47e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -cb0a840b603fb7d32d16b91bd5f23be7 sec-2.7.8.tar.gz +6c88c7fbb19e0eaea704aaf87924a6a9 sec-2.7.9.tar.gz From 9baef276ccac85e8d431cff06e2492ce35ca1fad Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Fri, 24 Jun 2016 17:23:27 +0200 Subject: [PATCH 26/32] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 979c84c..970a9e5 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ sec-2.5.3.tar.gz /sec-2.7.7.tar.gz /sec-2.7.8.tar.gz /sec-2.7.9.tar.gz +/sec-2.7.10.tar.gz diff --git a/sec.spec b/sec.spec index 726d0f5..c175758 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.9 +Version: 2.7.10 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Fri Jun 24 2016 Stefan Schulze Frielinghaus - 2.7.10-0 +- New upstream release + * Sat Apr 2 2016 Stefan Schulze Frielinghaus - 2.7.9-0 - New upstream release diff --git a/sources b/sources index ab9e47e..d6ee327 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -6c88c7fbb19e0eaea704aaf87924a6a9 sec-2.7.9.tar.gz +ece054278a50f21b7132f9743fa2b8ac sec-2.7.10.tar.gz From 9fa9053df259fa2ac0d27979f38ef9079046fb15 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 5 Feb 2017 19:01:26 +0100 Subject: [PATCH 27/32] New upstream release --- .gitignore | 1 + sec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 970a9e5..1d99850 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ sec-2.5.3.tar.gz /sec-2.7.8.tar.gz /sec-2.7.9.tar.gz /sec-2.7.10.tar.gz +/sec-2.7.11.tar.gz diff --git a/sec.spec b/sec.spec index c175758..d2db7cd 100644 --- a/sec.spec +++ b/sec.spec @@ -1,10 +1,10 @@ Name: sec -Version: 2.7.10 +Version: 2.7.11 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ -URL: http://simple-evcorr.sourceforge.net/ +URL: http://simple-evcorr.github.io/ Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz Source1: sec.sysconfig Source2: sec.init @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Sun Feb 5 2017 Stefan Schulze Frielinghaus - 2.7.11-0 +- New upstream release + * Fri Jun 24 2016 Stefan Schulze Frielinghaus - 2.7.10-0 - New upstream release diff --git a/sources b/sources index d6ee327..22632da 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -ece054278a50f21b7132f9743fa2b8ac sec-2.7.10.tar.gz +SHA512 (sec-2.7.11.tar.gz) = 2de3c131f85029a91e7db1405be236b8ef31454bdffa28d5a2f912af73a2d0b0fbfb37a2f1548f7899ae3c43248e9c20084b7cb55a6b309c00d103d8b8019e80 From 667d9663c5565c32c0a8b19004a72926445c66cb Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 13 Dec 2017 18:32:17 +0100 Subject: [PATCH 28/32] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 1d99850..fb3f771 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ sec-2.5.3.tar.gz /sec-2.7.9.tar.gz /sec-2.7.10.tar.gz /sec-2.7.11.tar.gz +/sec-2.7.12.tar.gz diff --git a/sec.spec b/sec.spec index d2db7cd..d4e94c1 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.11 +Version: 2.7.12 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Wed Dec 13 2017 Stefan Schulze Frielinghaus - 2.7.12-0 +- New upstream release + * Sun Feb 5 2017 Stefan Schulze Frielinghaus - 2.7.11-0 - New upstream release diff --git a/sources b/sources index 22632da..8bf645b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.7.11.tar.gz) = 2de3c131f85029a91e7db1405be236b8ef31454bdffa28d5a2f912af73a2d0b0fbfb37a2f1548f7899ae3c43248e9c20084b7cb55a6b309c00d103d8b8019e80 +SHA512 (sec-2.7.12.tar.gz) = 927ce602057c58993d7abd0aca0a7cde7ce6f77af01f72a414d165b93326a8e0a12bb5bc8c1f8d7737416beb16de92911db5ea20a8109e343e2e26e8efc649bd From 0ea297d9b9be351e7715f23985e1c4b37805ea47 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sun, 2 Sep 2018 14:52:04 +0200 Subject: [PATCH 29/32] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index fb3f771..0e3ee05 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ sec-2.5.3.tar.gz /sec-2.7.10.tar.gz /sec-2.7.11.tar.gz /sec-2.7.12.tar.gz +/sec-2.8.0.tar.gz diff --git a/sec.spec b/sec.spec index d4e94c1..f130f3d 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.7.12 +Version: 2.8.0 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Sun Sep 02 2018 Stefan Schulze Frielinghaus - 2.8.0-0 +- New upstream release + * Wed Dec 13 2017 Stefan Schulze Frielinghaus - 2.7.12-0 - New upstream release diff --git a/sources b/sources index 8bf645b..be96213 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.7.12.tar.gz) = 927ce602057c58993d7abd0aca0a7cde7ce6f77af01f72a414d165b93326a8e0a12bb5bc8c1f8d7737416beb16de92911db5ea20a8109e343e2e26e8efc649bd +SHA512 (sec-2.8.0.tar.gz) = e0a4bdc07c80ef6b061b20d4b444ff8dc406a63cf48a77defa3563d6980f5b5bc9f6ff8d70b2ff51e9f40955655ad3c750be5a01726a848b80a84aec0d6d1bad From 15e346fbf791c033fc3c4c756a048b16fef49527 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Wed, 3 Oct 2018 20:43:57 +0200 Subject: [PATCH 30/32] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 0e3ee05..b66c471 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ sec-2.5.3.tar.gz /sec-2.7.11.tar.gz /sec-2.7.12.tar.gz /sec-2.8.0.tar.gz +/sec-2.8.1.tar.gz diff --git a/sec.spec b/sec.spec index f130f3d..218cc05 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.8.0 +Version: 2.8.1 Release: 0%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -106,6 +106,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Wed Oct 3 2018 Stefan Schulze Frielinghaus - 2.8.1-0 +- New upstream release + * Sun Sep 02 2018 Stefan Schulze Frielinghaus - 2.8.0-0 - New upstream release diff --git a/sources b/sources index be96213..d3e3552 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.8.0.tar.gz) = e0a4bdc07c80ef6b061b20d4b444ff8dc406a63cf48a77defa3563d6980f5b5bc9f6ff8d70b2ff51e9f40955655ad3c750be5a01726a848b80a84aec0d6d1bad +SHA512 (sec-2.8.1.tar.gz) = 03c7acd1e1cfd6dc11143e0ff35758925ddc75e460987a91d5606564f0caa45afade497b8653ec2d8865cfcfab4d87743777eb104e1a16f79069cf61e17d0661 From 6c55b761f6954ffe791d9872d9d5de26fdd3a413 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Thu, 6 Jun 2019 21:26:18 +0200 Subject: [PATCH 31/32] - New upstream release - Clean up spec file --- .gitignore | 1 + amavisd.sec | 24 -- bsd-MONITOR.sec | 59 --- bsd-PHYSMOD.sec | 50 --- bsd-USERACT.sec | 81 ---- bsd-general.sec | 307 -------------- bsd-mpd.sec | 26 -- cisco-syslog.sec | 477 --------------------- conf.README | 14 +- cvs.sec | 44 -- dameware.sec | 24 -- hp-openview.sec | 114 ----- labrea.sec | 36 -- pix-general.sec | 1046 ---------------------------------------------- pix-security.sec | 246 ----------- pix-url.sec | 80 ---- portscan.sec | 45 -- sec.spec | 45 +- snort.sec | 163 -------- snortsam.sec | 77 ---- sources | 2 +- ssh-brute.sec | 69 --- ssh.sec | 260 ------------ vtund.sec | 67 --- windows.sec | 44 -- 25 files changed, 19 insertions(+), 3382 deletions(-) delete mode 100644 amavisd.sec delete mode 100644 bsd-MONITOR.sec delete mode 100644 bsd-PHYSMOD.sec delete mode 100644 bsd-USERACT.sec delete mode 100644 bsd-general.sec delete mode 100644 bsd-mpd.sec delete mode 100644 cisco-syslog.sec delete mode 100644 cvs.sec delete mode 100644 dameware.sec delete mode 100644 hp-openview.sec delete mode 100644 labrea.sec delete mode 100644 pix-general.sec delete mode 100644 pix-security.sec delete mode 100644 pix-url.sec delete mode 100644 portscan.sec delete mode 100644 snort.sec delete mode 100644 snortsam.sec delete mode 100644 ssh-brute.sec delete mode 100644 ssh.sec delete mode 100644 vtund.sec delete mode 100644 windows.sec diff --git a/.gitignore b/.gitignore index b66c471..10f38ca 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ sec-2.5.3.tar.gz /sec-2.7.12.tar.gz /sec-2.8.0.tar.gz /sec-2.8.1.tar.gz +/sec-2.8.2.tar.gz diff --git a/amavisd.sec b/amavisd.sec deleted file mode 100644 index d022e1c..0000000 --- a/amavisd.sec +++ /dev/null @@ -1,24 +0,0 @@ -############################################################################# -# Amavisd events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -#Sep 4 15:43:02 xxxxx clamd[581]: /var/amavisd/amavis-20050904T153955-46858/parts/part-00001: HTML.Phishing.Bank-1 FOUND -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND -desc=$0 -action=add GENERAL_REPORT CLAMD: $2 on $1 - -#Sep 4 00:02:46 xxxxx amavis[57825]: (57825-12) TROUBLE in check_mail: creating_partsdir FAILED: DBD::mysql::st execute failed: L -ost connection to MySQL server during query at (eval 53) line 238, line 1789. -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+amavis\[\d+\]: .* TROUBLE .* -desc=$0 -action=add GENERAL_REPORT AMAVISD: $1: %s - diff --git a/bsd-MONITOR.sec b/bsd-MONITOR.sec deleted file mode 100644 index 889ec98..0000000 --- a/bsd-MONITOR.sec +++ /dev/null @@ -1,59 +0,0 @@ -# -# SEC rules to pick up disruptive monitoring -# events. -# -# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# -# Copyright (C) 2003-2009 Jim Brown -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -# -#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) -#---------------------------------------------------------------------- -#Nov 15 20:02:48 foohost syslogd: exiting on signal 15 -#Nov 22 02:00:02 foohost syslogd: restart -#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled -#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled -# - -# -# Syslog Exit -# ----------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+) -desc=$0 -action=write - MONITOR: $1 syslog exit on signal $2 at %t - -# -# Syslog Restart -# --------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart -desc=$0 -action=write - MONITOR: $1 syslog restart at %t - -# -# Syslog Exit -# ----------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+) -desc=$0 -action=write - MONITOR: $1 $2 promiscuous mode $3 at %t - -# -# Swapspace failure -# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+kernel: swap_pager_getswapspace\(\S\): .* -desc=$0 -action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@example.com - diff --git a/bsd-PHYSMOD.sec b/bsd-PHYSMOD.sec deleted file mode 100644 index 03b348f..0000000 --- a/bsd-PHYSMOD.sec +++ /dev/null @@ -1,50 +0,0 @@ -# -# PHYSMOD.conf - Events concerning physical modifications -# to the system. -# -# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# -# Copyright (C) 2003-2009 Jim Brown -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -# -#Logs involving physical modifications (PHYSMOD) -#------------------------------------------------ -#Nov 14 21:11:19 foohost /kernel: pccard: card inserted, slot 0 -#Nov 14 22:28:09 foohost /kernel: pccard: card removed, slot 0 -#Nov 12 19:46:31 foohost /kernel: de0: link down: cable problem? -#Nov 12 19:46:42 foohost /kernel: de0: autosense failed: cable problem? -#Oct 18 06:26:37 foohost pccardd[49]: ep0: 3Com Corporation (/3C589/) inserted. -#Oct 18 06:26:42 foohost pccardd[49]: pccardd started -# - -# -# PCMCIA Card Insertion, Removal -# -------------------------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pccard: card (\S+), slot (\d+) -desc=$0 -action=write - PHYSMOD: $1 pccard: card $2 in slot $3 at %t - -# -# PCMCIA Card Daemon -# -------------------------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+pccardd\[\d+\]: (.*) -desc=$0 -action=write - PHYSMOD: $1 pccardd: $2 at %t - -# -# Cabling Problem -# ---------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem -desc=$0 -action=write - PHYSMOD: $1 cable problem on $2, text: $3 at %t diff --git a/bsd-USERACT.sec b/bsd-USERACT.sec deleted file mode 100644 index edf2557..0000000 --- a/bsd-USERACT.sec +++ /dev/null @@ -1,81 +0,0 @@ -# -# Events concerning user activities. -# -# From http://sixshooter.v6.thrupoint.net/SEC-examples/article.html -# -# Copyright (C) 2003-2009 Jim Brown -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -# -#Logs involving logins, change of UID and privilege escalations (USERACT) -#------------------------------------------------------------------------- -#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1 -#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100 -#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for jpb from 192.168.1.1 port 1077 ssh2 -#Nov 14 12:55:29 foohost sshd[3425]: Accepted keyboard-interactive/pam for jpb from fe80::2c0:4fff:fe18:13fd%ep0 port 27492 ssh2 -#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2 -#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql -#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0 -#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1 -#Oct 18 06:11:11 foohost login: login on ttyv0 as root -#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 -#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 -#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 -# - -# -# sshd Problems -# -------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) -desc=$0 -action=write - USERACT: $1 sshd $2 problem, text: $3 at %t - -# -# sshd Accepted -# -------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*) -desc=$0 -action=write - USERACT: $1 sshd accepted login, text: $2 at %t - -# -# login FAILURES -# --------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*) -desc=$0 -action=write - USERACT: $1 login $2 on $4 at %t - -# -# su bad -# ----------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) -desc=$0 -action=write - USERACT: $1 su: $2 $3 to $4 on $5 at %t - -#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 -#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 -#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 -# -# -# su good to root -# ----------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) -desc=$0 -action=write - USERACT: $1 su: $2 to ROOT on $4 at %t - - diff --git a/bsd-general.sec b/bsd-general.sec deleted file mode 100644 index 457b39b..0000000 --- a/bsd-general.sec +++ /dev/null @@ -1,307 +0,0 @@ -# General log events, unix systems. From various sources -# -# Copyright (C) 2003-2009 Jim Brown -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -# -# Bad su -# ----------- -# -type=Single -ptype=RegExp -desc=$0 -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) -action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com - -type=Single -ptype=RegExp -desc=$0 -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+) -action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com - - -# MONITOR.conf - SEC rules to pick up disruptive monitoring -# events. -# -#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR) -#---------------------------------------------------------------------- -#Nov 15 20:02:48 foohost syslogd: exiting on signal 15 -#Nov 22 02:00:02 foohost syslogd: restart -#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled -#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled -# - -# -# Syslog Exit -# ----------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+) -desc=$0 -action=write - MONITOR: $1 syslog exit on signal $2 at %t - -# -# Syslog Restart -# --------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart -desc=$0 -action=write - MONITOR: $1 syslog restart at %t - -# -# Syslog Exit -# ----------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+) -desc=$0 -action=write - MONITOR: $1 $2 promiscuous mode $3 at %t - - -# -# sshd Problems -# -------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) -desc=$0 -action=write - USERACT: $1 sshd $2 problem, text: $3 at %t - -# -# sshd Accepted -# -------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*) -desc=$0 -action=write - USERACT: $1 sshd accepted login, text: $2 at %t - -# -# login FAILURES -# --------------- -# -#type=Single -#ptype=RegExp -#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*) -#desc=$0 -#action=write - USERACT: $1 login $2 on $4 at %t - - -#SSH Auth failure on bsd 5 -#type=Single -#ptype=RegExp -#pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: error: PAM: authentication error for (/S+) from (/S+) -#desc=$0 -#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' alerts@example.com - -# -# su bad -# ----------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+) -desc=$0 -action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com - -#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0 -#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3 -#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0 -# -# -# su good to root -# ----------------- -# -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+) -desc=$0 -action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com -#action=write - USERACT: $1 su: $2 to ROOT on $4 at %t - -# -# Cabling Problem -# ---------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem -desc=$0 -action=event 0 $1 PHYSMOD:ORANGE cable problem on $2, text: $3 at %t - - - -# USERACT - Events concerning user activities. -# -# Sample BSD logs involving logins, change of UID and privilege escalations. -#--------------------------------------------------------------------------- -#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1 -#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100 -#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for foouser from 192.168.1.1 port 1077 ssh2 -#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2 -#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql -#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0 -#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1 -#Oct 18 06:11:11 foohost login: login on ttyv0 as root -#Nov 10 19:40:03 foohost su: foouser to root on /dev/ttyp0 -#Nov 18 09:37:38 foohost su: BAD SU foouser to root on /dev/ttyp3 -#Nov 22 12:26:44 foohost su: BAD SU goodboy to root on /dev/ttyp0 -# - -# -# sshd Problems -# -------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*) -desc=$0 -action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com -#action=event 0 $1 USERACT:YELLOW sshd $2 problem, text: $3 at %t - -# -# login FAILURES -# --------------- -# ORANGE -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(sshd|login): (.*?FAILURE.)(.*?ON) (.*) -desc=$0 -action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com -#action=event 0 $1 USERACT:YELLOW login $2 on $4 at %t - - -# NETWACT - SEC rules to pick up suspicious network events. -# -# Sample BSD logs involving odd or suspicious network activity. -#-------------------------------------------------------------- -#Jun 3 17:46:24 foohost named[38298]: client 10.12.127.176#3714: request has invalid signature: tsig verify failure -#Apr 14 16:23:08 foohost /kernel: arp: 10.10.152.12 moved from 00:90:27:37:35:cf to 00:d0:59:aa:61:11 on de0 -#Apr 1 11:23:39 sixshooter /kernel: Limiting closed port RST response from 368 to 200 packets per second - - -# -# named Dynamic DNS Update rejection -# ---------------------------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+named\[\d+\]: client (\S+): request has invalid signature:(.*) -desc=$0 -action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" alerts@example.com - -# -# MAC address moved -# ----------------- -# ORANGE -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: arp: (\S+) moved from (\S+) to (\S+) on (\S+) -desc=$0 -action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" alerts@example.com - -# -# DoS RST rate limit -# ------------------ -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Limiting closed port RST response from (\d+) to (\d+) -desc=$0 -action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" alerts@example.com - - - -# COMPROM - SEC rules to pick up potential system compromise events. -# -# Sample BSD logs involving potential system compromise. -#------------------------------------------------------- -#May 25 18:09:55 foohost ntpd[1325]: ntpd exiting on signal 11 -#Jul 21 18:33:16 foohost /kernel: pid 55454 (ftpd), uid 1001: exited on signal 8 -#Apr 9 12:57:06 foohost /kernel: pid 28039 (telnet), uid 0: exited on signal 3 (core dumped) - -# -# ntpd crash -# ------------------ -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+ntpd\[\d+\]: ntpd exiting on signal (\d+) -desc=$0 -action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" alerts@example.com - -# -# Process crash -# ------------------ -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pid \d+ \(\S+\), uid (\d+): exited on signal (\d+) -desc=$0 -action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" alerts@example.com - - - -# PROCESS - SEC rules to pick up suspicious process events. -# -# Sample BSD logs involving unusual processes. -#--------------------------------------------- -#Mar 23 08:05:52 foohost thttpd[126]: thttpd/2.25b 29dec2003 starting on port 8090 - -# -# Suspicious processes -# -------------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(thttpd)\[(\d+)\]:(.*) -desc=$0 -action=pipe 'SUSPROC: $1 suspicious process $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process $2" alerts@example.com - - - -# SHUTRST - SEC rules to pick up system shutdown, restart events. -# -# Sample BSD logs involving system shutdown and reset. -#----------------------------------------------------- -#Mar 6 16:28:13 foohost reboot: rebooted by foouser -#Jul 15 17:35:49 foohost halt: halted by root -#Mar 6 16:29:17 foohost /kernel: Copyright (c) 1992-2003 The FreeBSD Project. - -# -# Reboot message -# -------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+reboot: rebooted by (\S+) -desc=$0 -action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" alerts@example.com - -# -# Halt message -# -------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+halt: halted by (\S+) -desc=$0 -action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" alerts@example.com - -# -# Restart message -# -------------- -# -type=Single -ptype=RegExp -pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Copyright \(c\) (\S+) The FreeBSD Project -desc=$0 -action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" alerts@example.com - diff --git a/bsd-mpd.sec b/bsd-mpd.sec deleted file mode 100644 index 594c556..0000000 --- a/bsd-mpd.sec +++ /dev/null @@ -1,26 +0,0 @@ -############################################################################# -# BSD mpd events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=single -desc = mpd connection start -ptype=regexp -pattern=([A-z._0-9-]*) mpd: PPTP connection from (\d+\.\d+\.\d+\.\d+):\d+ -action=add GENERAL_REPORT MPD Start from $2 on $1 - -type=single -ptype=regexp -pattern=([A-z._0-9-]*) mpd: Name: (.*) -desc = mpd user auth -action=add GENERAL_REPORT MPD User $2 Auth on $1 - -type=Single -ptype=RegExp -pattern=([A-z._0-9-]*) mpd: pptp\d: killing connection with (\d+\.\d+\.\d+\.\d+):\d+ -desc=mpd connection end -action=add GENERAL_REPORT MPD Connection end from $2 on $1 diff --git a/cisco-syslog.sec b/cisco-syslog.sec deleted file mode 100644 index 3ee22ea..0000000 --- a/cisco-syslog.sec +++ /dev/null @@ -1,477 +0,0 @@ -############################################################################# -# SEC rules for processing Cisco syslog messages -# -# Copyright (C) 2008-2009 Omer Ben-Shalom, Risto Vaarandi -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -# ----- Process system configuration events ----- - -# System configuration events -# suppressed because we don't care about it -# -type=suppress -ptype=substr -pattern=%SYS-5-CONFIG_I: -desc=device configuration - -# System configuration sync to standby router -# suppressed because we don't care about it -# -type=suppress -ptype=substr -pattern=%PFINIT-SP-5-CONFIG_SYNC: -desc=config sync - -# ----- Process reload and restart events ----- - -# Looks for a reload -# -type=single -continue=takeNext -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: (.*) -desc=(WARNING) reload requested for $1 -action=pipe '%s details:$2' mail -s 'cisco event' root@example.com - -# Looks for a reload followed by a restart event -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: -desc=(CRITICAL) $1 RELOAD_PROBLEM -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1).*?%SYS-5-RESTART: -desc2=(NOTICE) $1 RELOAD_OK -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=300 - -# Looks for a restart without reload command -# -type=single -ptype=regexp -pattern=(\S+) \d+:.*?%SYS-5-RESTART: -desc=(CRITICAL) $1 restart without reload command -action=pipe '%s' mail -s 'cisco event' root@example.com - -# ----- process SNMP authentication failure events ----- - -# this rule handles the SNMP authentication failures -# only one notification is sent for each source that is doing this per day -# -type=singleWithSuppress -ptype=regexp -pattern=(\S+) \d+:.*?%SNMP-3-AUTHFAIL: Authentication failure for SNMP req from host (\S+) -desc=(WARNING) Auth fail coming from $2 -action=pipe '%s' mail -s 'cisco event' root@example.com -window=86400 - -# ----- process OSPF neighbor change events ----- - -# This rule handles OSPF neighbor changes -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OSPF-5-ADJCHG:.*?Nbr (\S+) on (\S+) from (\S+) to (\S+), (.*) -desc=(MINOR) OSPF adjacency change: Router $1 reports that the neighbor on $3 ($2) changed from state $4 to state $5 detail:$6 -action=event %s; pipe '%s' mail -s 'cisco event' root@example.com - -# This rule escalates to CRITICAL if there are more than 5 neighbor changes -# in 5 seconds -# -type=SingleWithThreshold -ptype=substr -pattern=(MINOR) OSPF adjacency change -desc=(CRITICAL) More than 5 OSPF neighbor changes in 5 seconds -action=pipe '%s' mail -s 'cisco event' root@example.com -thresh=5 -window=5 - -# ----- process HSRP events ----- - -# This rule assembles together all HSRP events -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%STANDBY-6-STATECHANGE: (\S+).*?state (\S+) -> (\S+) -desc=HSRP change for $1 interface $2 - changed from $3 to $4 -action=add HSRP_$1 %t: %s; set HSRP_$1 5 (report HSRP_$1 mail -s 'cisco events' root@example.com) - -# ----- process duplex mismatch events ----- - -# this rule handles the duplex mismatch event -# only one notification is sent for each port that has duplex mismatch -# reported per day -# -type=singleWithSuppress -ptype=regexp -pattern=(\S+) \d+:.*?%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on (not \S+) \((.*?)\), with (\S+) (\S+) \((.*?)\) -desc=(WARNING) Duplex mismatch between $1 port $2 ($3), other side is $4 port $5 ($6) -action=pipe '%s' mail -s 'cisco event' root@example.com -window=86400 - -# ----- process link down and link up events ----- - -# This rule deals with link down events -# -type=PairWithWindow -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINK-3-UPDOWN: Interface (\S+), changed state to down -desc=(MINOR) $1 INTERFACE $2 DOWN and not up in one minute -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=RegExp -pattern2=($1)\s+\d+:.*?%LINK-3-UPDOWN: Interface ($2), changed state to up -desc2=(WARNING) %1 INTERFACE %2 BOUNCE -action2=event %s -window=60 - -# when the first bounce event is seen, create a reporting trigger -# -type=Single -continue=TakeNext -ptype=regexp -pattern=(\S+) INTERFACE \S+ BOUNCE -context=!INTERFACE_BOUNCE_WAIT_$1 -desc=interface bounce summary event for router $1 -action=create INTERFACE_BOUNCE_WAIT_$1 10 (report INTERFACE_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete INTERFACE_BOUNCE_$1) - -# accumulate all interface bounce events into a context -# -type=Single -ptype=regexp -pattern=(\S+) INTERFACE (\S+) BOUNCE -desc=interface bounce for router $1 interface $2 detected -action=add INTERFACE_BOUNCE_$1 %t: %s - -# ----- process line protocol down and line protocol up events ----- - -# This rule deals with protocol up/down events -# -type=PairWithWindow -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface (\S+), changed state to down -desc=(MINOR) $1 INTERFACE $2 line protocol DOWN and not up in one minute -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=RegExp -pattern2=($1)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface ($2), changed state to up -desc2=(WARNING) %1 INTERFACE %2 line protocol BOUNCE -action2=event %s -window=60 - -# when the first bounce event is seen, create a reporting trigger -# -type=Single -continue=TakeNext -ptype=regexp -pattern=(\S+) INTERFACE \S+ line protocol BOUNCE -context=!LINE_PROTOCOL_BOUNCE_WAIT_$1 -desc=line protocol bounce for router $1 -action=create LINE_PROTOCOL_BOUNCE_WAIT_$1 10 (report LINE_PROTOCOL_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete LINE_PROTOCOL_BOUNCE_$1) - -# accumulate all line protocol bounce events into a context -# -type=Single -ptype=regexp -pattern=(\S+) INTERFACE (\S+) line protocol BOUNCE -desc=line protocol bounce for router $1 interface $2 detected -action=add LINE_PROTOCOL_BOUNCE_$1 %t: %s - -# ----- process late collision events ----- - -# Late collision alerts -# -type=SingleWithThreshold -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%PM_SCP-SP-4-LCP_FW_ABLC: Late collision message from module (\d+), port:(\d+) -desc=(MINOR) Multiple late collision events on $1 module $2 port $3 -action=pipe '%s' mail -s 'cisco event' root@example.com -window=3600 -thresh=5 - -# ----- process host flap events ----- - -# host flapping on single vlan -# -type=SingleWithThreshold -continue=TakeNext -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+) -desc=(MINOR) multiple hosts flapping between ports $4 and $5 in $1 vlan $3 -action=pipe '%s' mail -s 'cisco event' root@example.com -window=300 -thresh=5 - -# host flapping on multiple vlans -# -type=SingleWithThreshold -continue=TakeNext -ptype=RegExp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+) -desc=(MINOR) multiple hosts are flapping between ports $4 and $5 in $1 (potentially on multiple VLANs) -action=pipe '%s' mail -s 'cisco event' root@example.com -window=300 -thresh=20 - -# ----- process misc hw events ----- - -# %FILESYS-SP-STDBY-5-DEV:# flash disk removal -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%FILESYS-SP-STDBY-5-DEV:.*?PCMCIA flash card removed from (\S+) -desc=(WARNING) Flash card removed from $1 $2 -action=pipe '%s' mail -s 'cisco event' root@example.com - -# %OIR-SP-STDBY-6-CONSOLE -# -type=suppress -ptype=substr -pattern=%OIR-SP-STDBY-6-CONSOLE -desc=console access to route processor changed - -# %OIR-SP-6-INSCARD: - card inserted -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OIR-SP-6-INSCARD: Card inserted in slot (\d+), (.*) -desc=(HARMLESS) card inserted in $1 slot $2 status:$3 -action=pipe '%s' mail -s 'cisco event' root@example.com - -# ----- process module events ----- - -# %DIAG-SP-3-TEST_FAIL - diagnostics failed on a module -# -type=single -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DIAG-SP-3-TEST_FAIL: Module (\d+): (.*) -desc=(WARNING) diagnostics failed for $1 module $2 detail:$3 -action=pipe '%s' mail -s 'cisco event' root@example.com - -# %SNMP-5-MODULETRAP -# Looks for a module down followed by module up event -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-MODULETRAP: Module (\d+) [Down] Trap -desc=(MINOR) $1 Module DOWN (not back up in a minute) -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1) .*? %SNMP-5-MODULETRAP: Module ($2) [Up] Trap -desc2=(WARNING) $1 Module $2 BOUNCE (down and back up within a minute) -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=60 - -# ----- process irrelevant events (by suppressing) ----- - -# %SYS-SP-STDBY-5-RESTART - system restarted part of the boot - interesting? -# -type=suppress -ptype=substr -pattern=SYS-SP-STDBY-5-RESTART -desc=system restarted - -# %DIAG-SP-6-TEST_RUNNING - Running system test -# -type=suppress -ptype=substr -pattern=%DIAG-SP-6-TEST_RUNNING -desc=running diagnostics on a module - -# %FABRIC-SP-5-FABRIC_MODULE_BACKUP - module changed to backup state -# -type=suppress -ptype=substr -pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP -desc=module became backup - -# %DIAG-SP-6-RUN_MINIMUM - diagnostics are run -# -type=suppress -ptype=substr -pattern=%DIAG-SP-6-RUN_MINIMUM -desc=diagnostics running on switch - -# %DIAG-SP-6-DIAG_OK - diagnostics results are OK -# -type=suppress -ptype=substr -pattern=%DIAG-SP-6-DIAG_OK -desc=diagnostics results are OK - -# %PFREDUN-SP-STDBY-6-STANDBY - SSO events -# -type=suppress -ptype=substr -pattern=%PFREDUN-SP-STDBY-6-STANDBY -desc=SSO event (startup) - -# %PFREDUN-SP-STDBY-6-STANDBY - SSO events -# -type=suppress -ptype=substr -pattern=%PFREDUN-SP-6-ACTIVE -desc=SSO event (startup) - -# %FABRIC-SP-5-FABRIC_MODULE_BACKUP: - secondary sup is up and is secondary -# -type=suppress -ptype=substr -pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP: -desc=secondary sup is up and is secondary - -# %PFINIT-SP-5-CONFIG_SYNC - startup config on standby router sync -# -type=suppress -ptype=substr -pattern=%PFINIT-SP-5-CONFIG_SYNC -desc=startup config on standby router sync - -# %C4K_REDUNDANCY - Cayt 4K configuration/vlan database succesful sync -# the success match is to allow fails in sync to not be suppress -# -type=suppress -ptype=regexp -pattern=%C4K_REDUNDANCY.*?success -desc=config sync with standby supervisor - -# %SCP-SP-5-ASYNC_WATERMARK: SCP long queue wait -# the success match is to allow fails in sync to not be suppress -# -type=suppress -ptype=substr -pattern=%SCP-SP-5-ASYNC_WATERMARK: -desc=SCP control protocol pending queue is longer than notification threshold - -# %MLS_RATE-4-DISABLING: - Layer2 Rate Limiters have been disabled. Is this interesting? -# -type=suppress -ptype=substr -pattern=%MLS_RATE-4-DISABLING: -desc=Layer2 Rate Limiters have been disabled - -# ----- process native VLAN mismatch events ----- - -# %CDP-4-NATIVE_VLAN_MISMATCH: - native VLAN mismatch between switches, will repeat every minute until fixed -# -type=singleWithSuppress -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on (\S+) \((\d+)\), with (\S+) (\S+) \((\d+)\) -desc=(MINOR) A native VLAN mistmatch reported between $1 interface $2 (native VLAN $3) and host $4 interface $5 (native VLAN $6) -action=pipe '%s' mail -s 'cisco event' root@example.com -window=60 - -# ----- process snmp trapblock messages ----- - -# %SNMP-3-TRAPBLOCK - A process tried to create a trap it is not entitled to create -# See Cisco http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&counter=0&paging=5&query=SNMP-3-TRAPBLOCK -# -type=suppress -ptype=substr -pattern=%SNMP-3-TRAPBLOCK -desc=a process tried to create a trap it is not entitled to create - -# ----- process chassis alarm events ----- - -# %SNMP-5-CHASSISALARM - this rule handles the tmpAlarm -# -type=pairWithWindow -continue=takeNext -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(ON\) -desc=(MINOR) $1 temprature alarm signaled and not cleared in five minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -continue2=takeNext -ptype2=regexp -pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(OFF\) -desc2=(WARNING) $1 temprature alarm went on and was cleared in under five minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=300 - -# %SNMP-5-CHASSISALARM - this rule handles the minorAlarm -# -type=pairWithWindow -continue=takeNext -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(ON\) -desc=(MINOR) $1 minor alarm reported and not cleared in three minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -continue2=takeNext -desc2=(WARNING) $1 minor alarm went on and was cleared in under three minutes -ptype2=regexp -pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(OFF\) -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=180 - -# %SNMP-5-CHASSISALARM - this rule handles the majorAlarm -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(ON\) -desc=(MINOR) $1 major alarm signaled and not cleared in two minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(OFF\) -desc2=(WARNING) $1 major alarm went on and was cleared in under two minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=120 - -# ----- process power supply related events ----- - -# %C4K_IOSMODPORTMAN events - this one is about power supplies only -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD: Power Supply (\d+) has failed or been turned off -desc=(MINOR) $1 power supply $2 reported bad and event not cleared in two minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1) .*? %C4K_IOSMODPORTMAN-6-POWERSUPPLYGOOD: Power Supply ($2) is Okay -desc2=(WARNING) $1 power supply $2 alarm went on and was cleared in under two minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=120 - -# ----- process neighbor down and neighbor up events ----- - -# %DVMRP-5-NBRDOWN -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DVMRP-5-NBRDOWN: Neighbor (\S+) went down on (\S+) -desc=(MINOR) $1 lost DVMRP neighbor $2 on interface $3 and it did not come up in two minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1) .*? %DVMRP-5-NBRUP: Neighbor ($2) is up on ($3) -desc2=(WARNING) $1 lost DVMRP neighbor $2 on interface $3 but id come up within two minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=120 - -# ----- process fan power supply failure/ok events ----- - -# %C6KENV-SP-4-PSFANF events - this one is about fan failures -# -type=pairWithWindow -ptype=regexp -pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C6KENV-SP-4-PSFANFAILED: the fan in power supply (\d+) has failed -desc=(MINOR) $1 fan in power supply $2 was reported bad and event not cleared in two minutes -action=pipe '%s' mail -s 'cisco event' root@example.com -ptype2=regexp -pattern2=($1) .*? %C6KENV-SP-4-PSFANOK: the fan in power supply (\d+) is OK -desc2=(WARNING) $1 fan in power supply $2 alarm went on and was cleared in under two minutes -action2=pipe '%s' mail -s 'cisco event' root@example.com -window=120 - -# ----- process events that have not been matched by any of above rules ----- - -# Default match -# this rule will match anything not previously matched but allows only -# one notification per day for each new event class seen -# -type=singleWithSuppress -ptype=regexp -pattern=(%.*?:) -desc=$1 -action=pipe '$0' mail -s 'cisco event' root@example.com -window=86400 diff --git a/conf.README b/conf.README index 7365c13..252ae6f 100644 --- a/conf.README +++ b/conf.README @@ -2,9 +2,11 @@ This is the SEC configuration directory. Because SEC usage varies so widely from user to user, this package is configured by default to not run. The commented-out default settings in /etc/sysconfig/sec will load any file in -this directory with a .sec suffix. Please look through the example files -included in /usr/share/doc/sec-/examples/ and install the ones you -want here (taking into account that the examples are generic and some of them -may need to be tweaked to work with your setup). You should also read the SEC -man page so you have at least a basic understanding of the SEC configuration -commands. +this directory with a .sec suffix. You can find several example rules at + + https://github.com/simple-evcorr/rulesets + +and install the ones you want here (taking into account that the examples are +generic and some of them may need to be tweaked to work with your setup). You +should also read the SEC man page so you have at least a basic understanding of +the SEC configuration commands. diff --git a/cvs.sec b/cvs.sec deleted file mode 100644 index ae5af5d..0000000 --- a/cvs.sec +++ /dev/null @@ -1,44 +0,0 @@ -############################################################################# -# CVS events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -#Jul 31 19:54:21 xxxx xinetd[2088]: START: cvspserver pid=16385 from=xx.xx.xx.xx - -type=single -desc = cvsp server connection start -ptype=regexp -pattern=([A-z._0-9-]*) xinetd\[\d+\]: START: cvspserver pid=\d+ from=(\d+\.\d+\.\d+\.\d+) -action=add GENERAL_REPORT CVS Connection from $2 on $1 - - -#Aug 5 10:38:29 xxxx cvs: password mismatch for username in /usr/local/cvsroot: PMOv/9hZsf6v. vs. PMMlzZLYrbthY - -type=single -ptype=regexp -pattern=([A-z._0-9-]*) cvs: password mismatch for (.*) in (.*) -desc = cvs login failure -action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@example.com - - -#Aug 5 10:38:49 xxxx cvs: attempt to root from account: username - -type=single -ptype=regexp -pattern=([A-z._0-9-]*) cvs: attempt to root from account: (.*) -desc = cvs login to root attempt -action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@example.com - - -#Aug 5 10:42:37 xxxx cvs: login failure (for /usr/local/cvsroot) - -type=single -ptype=regexp -pattern=([A-z._0-9-]*) cvs: login failure \(for /usr/local/cvsroot\) -desc = cvs login failure -action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@example.com - diff --git a/dameware.sec b/dameware.sec deleted file mode 100644 index 8dd5201..0000000 --- a/dameware.sec +++ /dev/null @@ -1,24 +0,0 @@ -############################################################################# -# Dameware events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -#Dameware Connect -type=single -ptype=regexp -pattern=([A-z._0-9-]*) DMWRCS: (.*) Connect: (.*) -desc = Dameware Connect -action=add WINDOWS_REPORT DAMEWARE CONNECT: %s; \ -pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@example.com - - -#Dameware Disconnect -type=single -ptype=regexp -pattern=([A-z._0-9-]*) DMWRCS: (.*) Disconnect: (.*) -desc = Dameware Disconnect -action=add WINDOWS_REPORT DAMEWARE DISCONNECT: %s diff --git a/hp-openview.sec b/hp-openview.sec deleted file mode 100644 index d579dbf..0000000 --- a/hp-openview.sec +++ /dev/null @@ -1,114 +0,0 @@ -################################################################ -# Sample SEC ruleset for HP OpenView ITO -# -# Copyright (C) 2003-2009 Risto Vaarandi -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -################################################################ - -# process Cisco linkDown/linkUp trap events received from -# HP OpenView ITO trap template through itostream plugin - -type=PairWithWindow -ptype=RegExp -pattern=node=(\S+).*msg_text=cisco linkdown trap on interface (\S+) -desc=CISCO $1 INTERFACE $2 DOWN -action=event %s; -continue2=TakeNext -ptype2=RegExp -pattern2=node=$1.*msg_text=cisco linkup trap on interface $2 -desc2=CISCO %1 INTERFACE %2 BOUNCE -action2=event %s; -window=20 - -type=SingleWithSuppress -continue=TakeNext -ptype=RegExp -pattern=CISCO (\S+) INTERFACE (\S+) DOWN -desc=cisco $1 interface $2 down -action=reset +1 %s -window=60 - -type=Pair -ptype=RegExp -pattern=CISCO (\S+) INTERFACE (\S+) DOWN -desc=cisco $1 interface $2 down -action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major down -ptype2=RegExp -pattern2=node=$1.*msg_text=cisco linkup trap on interface $2 -desc2=cisco %1 interface %2 up -action2=shellcmd /home/opc_op/cisco_msg.sh %1 %2 normal up -window=86400 - -type=SingleWith2Thresholds -ptype=RegExp -pattern=CISCO (\S+) INTERFACE (\S+) BOUNCE -desc=cisco $1 interface $2 is unstable -action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major unstable -window=3600 -thresh=10 -desc2=cisco $1 interface $2 is stable again -action2=shellcmd /home/opc_op/cisco_msg.sh $1 $2 normal stable -window2=10800 -thresh2=0 - -# -# the cisco_msg.sh script: -# -##!/bin/sh -# -#NODE=$1 -#IF=$2 -#SEV=$3 -#TEXT=$4 -# -## use snmpget utility from Net-SNMP package -#IFNAME=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.2.1.2.2.1.2.$IF` -#DESCR=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.4.1.9.2.2.1.1.28.$IF` -# -#MSG=`echo "Interface $IFNAME ($DESCR) $TEXT" | sed s/\"/\'/g` -# -#/opt/OV/bin/OpC/opcmsg node=$NODE app=cisco obj=if \ -# sev=$SEV msg_grp=Network msg_text="$MSG" -# - - -# process APC ups "not online" trap events received from -# HP OpenView ITO trap template through itostream plugin - -type=SingleWithScript -ptype=RegExp -pattern=node=(\S+).*msg_text=APC ups not online -script=/home/opc_op/check_apc.sh $1 -desc=APC ups is not online! -action=shellcmd /opt/OV/bin/OpC/opcmsg node=$1 app=APC obj=state \ - msg_grp=UPS sev=critical msg_text='%s' - -# -# the check_apc.sh script -# -##!/bin/sh -# -## sleep for a few seconds and check if the UPS error is still present; -## if it is, exit with 0, otherwise exit with 1 -# -#UPS=$1 -#sleep 5 -# -## use snmpget utility from Net-SNMP package -#STATUS=`/usr/bin/snmpget -c public -OQve $UPS .1.3.6.1.4.1.318.1.1.1.4.1.1.0` -# -## According to the APC Powernet MIB the variable .1.3.6.1.4.1.318.1.1.1.4.1.1 -## takes the the following values: unknown(1), onLine(2), onBattery(3), -## onSmartBoost(4), timedSleeping(5), softwareBypass(6), off(7), rebooting(8), -## switchedBypass(9), hardwareFailureBypass(10), sleepingUntilPowerReturn(11), -## and onSmartTrim(12), where onLine(2) is the normal state for the UPS -# -#if [ $STATUS -eq 2 ] -#then -# exit 1 -#else -# exit 0 -#fi -# diff --git a/labrea.sec b/labrea.sec deleted file mode 100644 index d27153a..0000000 --- a/labrea.sec +++ /dev/null @@ -1,36 +0,0 @@ -############################################################################# -# Labrea tarpit events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Initial Connect \(tarpitting\): (\d+\.\d+\.\d+\.\d+\s\d+) \-> \d+\.\d+\.\d+\.\d+\s(.*) -desc=$0 -action=add TARPIT_REPORT %t: $1 New Tarpitted Connect from $2 on port $3 - -#type=Single -#ptype=RegExp -#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Additional Activity: (\d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ (\d+)* -#desc=$0 -#action=add TARPIT_REPORT %t: %s; -# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Responded to a PING: (d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ -desc=$0 -action=add TARPIT_REPORT %t: PING Sweep from $@ on $3 - -#Send hourly tarpit report - -type=Calendar -time=0 8,12,20 * * * -desc=Sending tarpit report... -action=report TARPIT_REPORT \ - /usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@example.com; \ - delete TARPIT_REPORT diff --git a/pix-general.sec b/pix-general.sec deleted file mode 100644 index 1aa9b87..0000000 --- a/pix-general.sec +++ /dev/null @@ -1,1046 +0,0 @@ -#################################################################### -# SEC ruleset for Cisco PIX 6.x, 7.x, FWSM 2.x -# -# Copyright (C) 2003-2009 Colin Hudler -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -#################################################################### - -# Process various events from PIX syslog output -# -# TODO -- A few FWSM log lines will not match. - -# Setup our variables -- not the right way to do this? Needs tweaking for your log lines -type=Single -ptype=RegExp -pattern=^(.* [0-9].:[0-9].:[0-9].) (.*)\.yourdomain\.edu.*?%(PIX|FWSM)-[0-9]-.*?:(.*) -desc=PIXLOG $2^ $1 $4 -action=event %s - -# 106001 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Inbound TCP connection denied from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+).* -desc=PIX $1 TCP connection denid HAMMER $2 to $3 -action=create ham1_$1; add ham1_$1 %t; add ham1_$1 %s;add ham1_$1 %s; add ham1_$1 $0; report ham1_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham1_$1 -window=10 -thresh=6 - -# 106006 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Connection denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+) -desc=PIX $1 denied by list HAMMER $2 to $3 -action=create ham2_$1; add ham2_$1 %t; add ham2_$1 %s; add ham2_$1 $0; report ham2_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham2_$1 -window=10 -thresh=6 - -# 106007 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny inbound UDP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) due to DNS.* -desc=PIX $1 Denied inbound UDP HAMMER $2 to $3 -action=create ham3_$1; add ham3_$1 %t; add ham3_$1 %s; add ham3_$1 $0; report ham3_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham3_$1 -window=10 -thresh=6 - -# 106010 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny inbound.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+).* -desc=PIX $1 Denied inbound HAMMER $2 to $3 -action=create ham4_$1; add ham4_$1 %t; add ham4_$1 %s; add ham4_$1 $0; report ham4_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham4_$1 -window=10 -thresh=6 - -# 106012 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny IP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+), IP options.* -desc=PIX $1 Denied IP Options HAMMER $2 to $3 -action=create ham5_$1; add ham5_$1 %t; add ham5_$1 %s; add ham5_$1 $0; report ham5_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham5_$1 -window=10 -thresh=6 - -# 106013 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Dropping echo request from (\d+.\d+.\d+.\d+) to PAT address -desc=PIX $1 Echo HAMMER $2 to PAT Address -action=create ham6_$1; add ham6_$1 %t; add ham6_$1 %s; add ham6_$1 $0; report ham7_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham8_$1 -window=10 -thresh=6 - -# 106014 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny inbound icmp src.*: (\d+.\d+.\d+.\d+) dst.*: (\d+.\d+.\d+.\d+) -desc=PIX $1 Deny inbound ICMP HAMMER $2 to $3 -action=create ham9_$1; add ham9_$1 %t; add ham9_$1 %s; add ham9_$1 $0; report ham9_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham9_$1 -window=10 -thresh=6 - -# 106015 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny.*\(no connection\) from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Deny (no connection) HAMMER $2 to $3 -action=create ham10_$1; add ham10_$1 %t; add ham10_$1 %s; add ham10_$1 $0; report ham10_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham10_$1 -window=10 -thresh=30 - -# 106016,106017,106020,106021,106022 is further down this list... - -# 106018 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*ICMP packet type.*denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+) -desc=PIX $1 Deny ICMP type HAMMER $2 to $3 -action=create ham11_$1; add ham11_$1 %t; add ham11_$1 %s; add ham11_$1 $0; report ham11_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham11_$1 -window=10 -thresh=6 - -# 106023 -#Deny udp src outside:128.135.93.11/137 dst inside:128.135.211.65/137 by access-group "inward" -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+) by .* -desc=PIX $1 Deny by ACL HAMMER $2 to $3 -action=create ham12_$1; add ham12_$1 %t; add ham12_$1 %s; add ham12_$1 $0; report ham12_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ham12_$1 -window=10 -thresh=32 - -# This is broken... still fix? TODO -# 106001 -- Report -#type=SingleWithThreshold -#continue=takenext -#ptype=RegExp -#pattern=^PIXLOG (\S+)\^ .*(Inbound TCP connection denied from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+).*)|\ -#(Connection denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+))|\ -#(Deny inbound UDP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) due to DNS)|\ -#(Deny inbound.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+))|\ -#(Deny IP from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+), IP options)|\ -#(Dropping echo request from (\d+.\d+.\d+.\d+) to PAT address)|\ -#(Deny inbound icmp src.*: (\d+.\d+.\d+.\d+) dst.*: (\d+.\d+.\d+.\d+))|\ -#(Deny.*\(no connection\) from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+))|\ -#(ICMP packet type.*denied by outbound list.*src (\d+.\d+.\d+.\d+) dest (\d+.\d+.\d+.\d+))|\ -#(Deny.*src.*:(\d+.\d+.\d+.\d+\/\d+) dst.*:(\d+.\d+.\d+.\d+\/\d+) by ) -#desc=PIX Conn Denied 10 times from $2 -#action=create rpt_$1; add rpt_$1 %t; add rpt_$1 %s;add rpt_$1 %s; add rpt_$1 $0; report rpt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpt_$1 -#window=10 -#thresh=30 - -# 101002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Bad failover cable. -desc=PIX $1 Bad Failover Cable -action=create bfc_$1; add bfc_$1 %t; add bfc_$1 %s; add bfc_$1 $0; report bfc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete bfc_$1 - -# 101003/4 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Failover cable not connected -desc=PIX $1 Failover cable gone -action=create nfc_$1; add nfc_$1 %t; add nfc_$1 %s; add nfc_$1 $0; report nfc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nfc_$1 - -# 101005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Error reading failover cable status -desc=PIX $1 Failover cable ERROR -action=create fce_$1; add fce_$1 %t; add fce_$1 %s; add fce_$1 $0; report fce_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fce_$1 - -# 102001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Power failure/System reload -desc=PIX $1 Peer Lost Power -action=create fpp_$1; add fpp_$1 %t; add fpp_$1 %s; add fpp_$1 $0; report fpp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpp_$1 - -# 103001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*No response from other firewall -desc=PIX $1 Peer Gone Away -action=create fnp_$1; add fnp_$1 %t; add fnp_$1 %s; add fnp_$1 $0; report fnp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fnp_$1 - -# 103003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Other firewall network interface (\S+) failed -desc=PIX $1 Peer interface $2 died -action=create fpi_$1; add fpi_$1 %t; add fpi_$1 %s; add fpi_$1 $0; report fpi_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpi_$1 - -# 103004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Other firewall reports this firewall failed -desc=PIX $1 Peer says I failed -action=create fif_$1; add fif_$1 %t; add fif_$1 %s; add fif_$1 $0; report fif_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fif_$1 - -# 103005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Other firewall reporting failure -desc=PIX $1 Peer reports failure -action=create fpf_$1; add fpf_$1 %t; add fpf_$1 %s; add fpf_$1 $0; report fpf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fpf_$1 - -# 104001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(Primary|Secondary) Switching to ACTIVE \(cause: (.*)\) -desc=PIX $1 FAILOVER! Becoming ACTIVE because $2 -action=create fba_$1; add fba_$1 %t; add fba_$1 %s; add fba_$1 $0; report fba_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fba_$1 - -# 104002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(Primary|Secondary) Switching to STNDBY \(cause: (.*)\) -desc=PIX $1 FAILOVER! Becoming STNDBY because $2 -action=create fbs_$1; add fbs_$1 %t; add fbs_$1 %s; add fsb_$1 $0; report fbs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fbs_$1 - -# 104003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Switching to FAILED -desc=PIX $1 IN FAILED STATE! -action=create ffs_$1; add ffs_$1 %t; add ffs_$1 %s; add ffs_$1 $0; report ffs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ffs_$1 - -# 104004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Switching to OK. -desc=PIX $1 Failed Unit is ok -action=create ffs_$1; add ffs_$1 %t; add ffs_$1 %s; add ffs_$1 $0; report ffs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ffs_$1 - -# 105005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Lost Failover communications with mate on interface -desc=PIX $1 Peer Gone Away -action=create fnp_$1; add fnp_$1 %t; add fnp_$1 %s; add fnp_$1 $0; report fnp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fnp_$1 - -# 105007 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Link status \'Down\' on interface (\S+).* -desc=PIX $1 interface $2 is DOWN -action=create ind_$1; add ind_$1 %t; add ind_$1 %s; add ind_$1 $0; report ind_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ind_$1 - -# 105011 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Failover cable communication failure -desc=PIX $1 Failver cable failed -action=create fcf_$1; add fcf_$1 %t; add fcf_$1 %s; add fcf_$1 $0; report fcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fcf_$1 - -# 105021 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Standby unit failed to sync due to a locked (\S+) config. Lock held by (\S+) -desc=PIX $1 Failover Sync failed because $2 is locked by $3 -action=create lck_$1; add fcf_$1 %t; add fcf_$1 %s; add lck_$1 $0; report lck_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lck_$1 - -# 10532 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LAN Failover interface is down -desc=PIX $1 Failover interface is down -action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 - -# 10535 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Receive a LAN failover interface down msg from peer. -desc=PIX $1 Failover Peer reports LAN interface down -action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 - -# 10536 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*dropped a LAN Failover command message. -desc=PIX $1 Failover Dropped a LAN packet -action=create fdr_$1; add fdr_$1 %t; add fdr_$1 %s; add fdr_$1 $0; report fdr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fdr_$1 - -# 10537 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*The primary and standby units are switching back -desc=PIX $1 Failover: primary and standby units are switching back -action=create fsw_$1; add fsw_$1 %t; add fsw_$1 %s; add fsw_$1 $0; report fsw_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsw_$1 - -# 10543 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Failover interface failed -desc=PIX $1 Failover LAN Interface is down! -action=create fin_$1; add fin_$1 %t; add fin_$1 %s; add fin_$1 $0; report fin_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fin_$1 - -# messages from 106001 moved to top - -# 106011 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny inbound (No xlate).* -desc=PIX $1 Same-Side Traffic Attack -action=create sst_$1; add sst_$1 %t; add sst_$1 %s; add sst_$1 $0; report sst_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sst_$1 - -# 106016 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny IP spoof from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) on interface -desc=PIX $1 IP Spoof from $2 to $3 -action=create spf_$1; add spf_$1 %t; add spf_$1 %s; add spf_$1 $0; report spf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spf_$1 - -# 106017 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny IP due to Land Attack from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) -desc=PIX $1 IP LAND Attack -action=create lnd_$1; add lnd_$1 %t; add lnd_$1 %s; add lnd_$1 $0; report lnd_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lnd_$1 - -# 106020 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny IP teardrop fragment.*from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) -desc=PIX $1 Teardrop Attack -action=create tdr_$1; add tdr_$1 %t; add tdr_$1 %s; add tdr_$1 $0; report tdr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tdr_$1 - -# 106021 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny.*reverse path check from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+).* -desc=PIX $1 Reverse Path Check Attack from $2 to $3 -action=create rpc_$1; add rpc_$1 %t; add rpc_$1 %s; add rpc_$1 $0; report rpc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpc_$1 - -# 106022 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Deny.*connection spoof from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+).* -desc=PIX $1 Connection Spoof Attack from $2 to $3 -action=create spf_$1; add spf_$1 %t; add spf_$1 %s; add spf_$1 $0; report spf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spf_$1 - -# 106024 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Access rules memory exhausted -desc=PIX $1 Out of ACL Memory! -action=create ame_$1; add ame_$1 %t; add ame_$1 %s; add ame_$1 $0; report ame_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ame_$1 - -# 106025/6 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Failed to determine the security context for the packet:(\S+):(\d+.\d+.\d+.\d+) (\d+.\d+.\d+.\d+) (\d+) (\d+).* -desc=PIX $1 failed getting context for vlan $2 $3:$4 to $5:$6 -action=create ctx_$1; add ctx_$1 %t; add ctx_$1 %s; add ctx_$1 $0; report ctx_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ctx_$1 - -# 107001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*RIP auth failed from (\d+.\d+.\d+.\d+).* -desc=PIX $1 RIP Auth Attack from $2 -action=create rip_$1; add rip_$1 %t; add rip_$1 %s; add rip_$1 $0; report rip_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rip_$1 - -# 107002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*RIP pkt failed from (\d+.\d+.\d+.\d+).* -desc=PIX $1 Invalid RIP Packet from $2 -action=create rpk_$1; add rpk_$1 %t; add rpk_$1 %s; add rpk_$1 $0; report rpk_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rpk_$1 - -# 109003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Auth from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+\/\d+) failed \(all servers failed\).* -desc=PIX $1 All AAA Failed from $2 to $3 -action=create aaa_$1; add aaa_$1 %t; add aaa_$1 %s; add aaa_$1 $0; report aaa_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete aaa_$1 - -# 109006/8 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(Authentication|Authorization) (failed|denied) for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Auth Guessing Attack by $2 from $3 to $4 -action=create brt_$1; add brt_$1 %t; add brt_$1 %s; add brt_$1 $0; report brt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete brt_$1 -window=10 -thresh=6 - -# 109010 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Auth from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) failed \(too many pending auths\).* -desc=PIX $1 Max Auths Reached for $2 to $3 -action=create mth_$1; add mth_$1 %t; add mth_$1 %s; add mth_$1 $0; report mth_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mth_$1 - -# 109017 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User at (\d+.\d+.\d+.\d+) exceeded auth proxy connection -desc=PIX $1 $2 has opened to many proxy conns -action=create pcn_$1; add pcn_$1 %t; add pcn_$1 %s; add pcn_$1 $0; report pcn_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pcn_$1 - -# 109024 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Authorization denied.*for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Authorization Denied HAMMER $2 from $3 to $4 -action=create uhm_$1; add uhm_$1 %t; add uhm_$1 %s; add uhm_$1 $0; report uhm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete uhm_$1 -window=10 -thresh=6 - -# 109025 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Authorization denied \(acl=.*\) for user \'(\S+)\' from (\d+.\d+.\d+.\d+\/\d+) to (\d+.\d+.\d+.\d+\/\d+) on interface.* -desc=PIX $1 Authorization Denied HAMMER $2 from $3 to $4 -action=create uhm_$1; add uhm_$1 %t; add uhm_$1 %s; add uhm_$1 $0; report uhm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete uhm_$1 -window=10 -thresh=6 - -# 111001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Begin configuration: (\d+.\d+.\d+.\d+) writing to (\S+) -desc=PIX $1 Config saved to $3 by $2 -action=create sav_$1; add sav_$1 %t; add sav_$1 %s; add sav_$1 $0; report sav_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sav_$1 - -# 111002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Begin configuration: (\d+.\d+.\d+.\d+) reading from (\S+) -desc=PIX $1 Config read from $3 by $2 -action=create sav_$1; add sav_$1 %t; add sav_$1 %s; add sav_$1 $0; report sav_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sav_$1 - -# 111003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(\d+.\d+.\d+.\d+) Erase configuration -desc=PIX $1 WRITE ERASE WAS ISSUED $2 -action=create ers_$1; add ers_$1 %t; add ers_$1 %s; add ers_$1 $0; report ers_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ers_$1 - -# 111004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*(\d+.\d+.\d+.\d+) end configuration: \[FAILED\] -desc=PIX $1 FAILED CONFIGURING $2 -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# 111008 -type=Single -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User \'(\S+)\' executed the command (.*) -desc=PIX $1 $2 executed: $3 -action=add CMD_REPORT $2 : $3 -#create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# FIXME -- Add syslog number -# FSWM Style -type=Single -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User \'(\S+)\' executed the \'(.*)\' command.* -desc=PIX $1 $2 executed: $3 -action=add CMD_REPORT $2 : $3 -#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - - -# 111008 -type=Single -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User (\S+) executed cmd:(.*) -desc=PIX $1 $2 executed: $3 -action=add CMD_REPORT $2 : $3 -#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 -#action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# 113001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Unable to open AAA session. Session limit -desc=PIX $1 AAA Reached session limit -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# 113005 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*AAA user authentication Rejected: reason = (.*) server = .* User = (\S+).* -desc=PIX $1 IPSEC: User Auth Attack: $2 for $3 -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 -window=10 -thresh=6 - -# 113006 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User (\S+) locked out on exceeding number successive failed authentication attempts -desc=PIX $1 User Locked out: $2 -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# 113020 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Kerberos error : Clock skew with server (\d+.\d+.\d+.\d+).* -desc=PIX $1 User Locked out: $2 -action=create cff_$1; add cff_$1 %t; add cff_$1 %s; add cff_$1 $0; report cff_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cff_$1 - -# Might be only 6.x -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Console Login from user at (\d+.\d+.\d+.\d+) -desc=PIX $1 Console Login from $2 -action=create con_$1; add con_$1 %t; add con_$1 %s; add con_$1 $0; report con_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete con_$1 - -# 112001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*clear (finished|complete)\. -desc=PIX $1 Clear Command Executed -action=create clr_$1; add clr_$1 %t; add clr_$1 %s; add clr_$1 $0; report clr_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete clr_$1 - -# 199002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*[rR]eload command executed from.*(\d+.\d+.\d+.\d+) -desc=PIX $1 Reloaded by $2 -action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 - -# 199002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Orderly reload started at.*by (\S+). Reload.* -desc=PIX $1 Reloaded by $2 -action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 - -# 201002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+).*Too many.*connections on (static|xlate) (\d+.\d+.\d+.\d+) -desc=PIX $1 Max Embryonics to $3 (not attack) -action=create max_$1; add max_$1 %t; add max_$1 %s; add max_$1 $0; report max_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete max_$1 - -# 201003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Embryonic limit exceeded.*for (\d+.\d+.\d+.\d+\/\d+) \((\d+.\d+.\d+.\d+)\) (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Max Embryonics from $2 to $3 ($4) Attack -action=create emb_$1; add emb_$1 %t; add emb_$1 %s; add emb_$1 $0; report emb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete emb_$1 - -# 201008 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*The PIX is disallowing new connections. -desc=PIX $1 No longer allowing connections! -action=create stp_$1; add stp_$1 %t; add stp_$1 %s; add stp_$1 $0; report stp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete stp_$1 - -# 202001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Out of address translation slots! -desc=PIX $1 Out of NAT Slots -action=create nnt_$1; add nnt_$1 %t; add nnt_$1 %s; add nnt_$1 $0; report nnt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nnt_$1 - -# 209003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Fragment database limit of.*exceeded: src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* -desc=PIX $1 No room to assemble more frags from $2 to $3 -action=create frg_$1; add frg_$1 %t; add frg_$1 %s; add frg_$1 $0; report frg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete frg_$1 - -# 209004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Invalid IP fragment, size =.*exceeds maximum size =.*src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* -desc=PIX $1 Frag is invalid from $2 to $3 -action=create lrg_$1; add lrg_$1 %t; add lrg_$1 %s; add lrg_$1 $0; report lrg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lrg_$1 - -# 209005 -# FIXME -- Cisco log message doesnt match this -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Discard IP fragment set with more than.*elements:src = (\d+.\d+.\d+.\d+), dest = (\d+.\d+.\d+.\d+).* -desc=PIX $1 To many frags from $2 to $3 -action=create _$1; add _$1 %t; add _$1 %s; add _$1 $0; report _$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete _$1 - -# 210002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU allocate block .* failed. -desc=PIX $1 Failover Block Alocation Failed -action=create fba_$1; add fba_$1 %t; add fba_$1 %s; add fba_$1 $0; report fba_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fba_$1 - -# 210005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU allocate connection failed -desc=PIX $1 Failover Connection Failed -action=create fcf_$1; add fcf_$1 %t; add fcf_$1 %s; add fcf_$1 $0; report fcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fcf_$1 - -# 210003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Unknown LU Object.* -desc=PIX $1 Failover: Unknown LU Object -action=create ulu_$1; add ulu_$1 %t; add ulu_$1 %s; add ulu_$1 $0; report ulu_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ulu_$1 - -# 210006 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU look NAT for (\d+.\d+.\d+.\d+) failed -desc=PIX $1 Failover NAT Sync failed for $2 -action=create fns_$1; add fns_$1 %t; add fns_$1 %s; add fns_$1 $0; report fns_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fns_$1 - -# 210007 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU allocate xlate failed -desc=PIX $1 Failover xlate Sync Failed -action=create fxs_$1; add fxs_$1 %t; add fxs_$1 %s; add fxs_$1 $0; report fxs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxs_$1 - -# 210008 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU no xlate for (\d+.\d+.\d+.\d+\/\d+) (\d+.\d+.\d+.\d+\/\d+) -desc=PIX $1 Failover xlate Sync Failure for $2 to $3 -action=create fxs_$1; add fxs_$1 %t; add fxs_$1 %s; add fxs_$1 $0; report fxs_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxs_$1 - -# 210010 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU make UDP connection for (\d+.\d+.\d+.\d+:\d+) (\d+.\d+.\d+.\d+:\d+) failed -desc=PIX $1 Failover UDP Conn sync failure for $2 to $3 -action=create fus_$1; add fus_$1 %t; add fus_$1 %s; add fus_$1 $0; report fus_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fus_$1 - -# 210020 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU PAT port (\d+) reserve failed -desc=PIX $1 Failover PAT Sync for $2 failed -action=create fps_$1; add fps_$1 %t; add fps_$1 %s; add fps_$1 $0; report fps_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fps_$1 - -# 210021 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU create static xlate (\d+.\d+.\d+.\d+).*failed -desc=PIX $1 Failover Static xlate failed for $2 -action=create fxf_$1; add fxf_$1 %t; add fxf_$1 %s; add fxf_$1 $0; report fxf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fxf_$1 - -# 210022 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*LU missed (\d+) updates -desc=PIX $1 Failover Sync failed for $2 updates -action=create fsf_$1; add fsf_$1 %t; add fsf_$1 %s; add fsf_$1 $0; report fsf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsf_$1 - -# 211001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Memory allocation Error -desc=PIX $1 Memory allocation Error! -action=create mae_$1; add mae_$1 %t; add mae_$1 %s; add mae_$1 $0; report mae_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mae_$1 - -# 211003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*CPU utilization for (\d+) seconds = (.*) -desc=PIX $1 CPU high ($2) for $3 secs -action=create cpu_$1; add cpu_$1 %t; add cpu_$1 %s; add cpu_$1 $0; report cpu_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete cpu_$1 - -# 211003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Dropping SNMP request from (\d+.\d+.\d+.\d+\/\d+) to.*:(\d+.\d+.\d+.\d+\/\d+).* -desc=PIX $1 SNMP Attempt from $2 to $3 -action=create snp_$1; add snp_$1 %t; add snp_$1 %s; add snp_$1 $0; report snp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete snp_$1 - -# 213001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPTP control daemon socket io.*errno = (\d+) -desc=PIX $1 PPTP Error $2 -action=create ppt_$1; add ppt_$1 %t; add ppt_$1 %s; add ppt_$1 $0; report ppt_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppt_$1 - -# 213002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPTP tunnel hashtable insert failed, peer = (\d+.\d+.\d+.\d+) -desc=PIX $1 PPTP hash table insert failed for $2 -action=create pht_$1; add pht_$1 %t; add pht_$1 %s; add pht_$1 $0; report pht_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pht_$1 - -# 213003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPP virtual interface (\S+) isn't opened. -desc=PIX $1 PPP Virtual Int $2 failed to close -action=create ppp_$1; add ppp_$1 %t; add ppp_$1 %s; add ppp_$1 $0; report ppp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppp_$1 - -# 213004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPP virtual interface (\S+) client ip allocation failed. -desc=PIX $1 PPP Virutal interface $2 failure (pool depleted) -action=create ppl_$1; add ppl_$1 %t; add ppl_$1 %s; add ppl_$1 $0; report ppl_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ppl_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Denied Telnet login session from (\d+.\d+.\d+.\d+) on interface (int_name). -desc=PIX $1 Denid Telnet from $2 ($3) !! -action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Permitted Telnet login session from (\d+.\d+.\d+.\d+) -desc=PIX $1 Permitted Telnet from $2 ! -action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*telnet login session failed from (\d+.\d+.\d+.\d+).* -desc=PIX $1 Telnet login guessing attack -action=create tel_$1; add tel_$1 %t; add tel_$1 %s; add tel_$1 $0; report tel_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete tel_$1 - -# 308001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PIX console enable password incorrect for (num) tries \(from (\d+.\d+.\d+.\d+)\). -desc=PIX $1 Many Enable Password failures for $3 -action=create enb_$1; add enb_$1 %t; add enb_$1 %s; add enb_$1 $0; report enb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enb_$1 - -# 315011 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*SSH session from (\d+.\d+.\d+.\d+) on interface.*for user (\S+) disconnected by SSH server, reason:.* -desc=PIX $1 SSH Auth Attach from $2 ($3) -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 %s; add ssh_$1 $0; report ssh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ssh_$1 -window=10 -thresh=6 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Denied manager connection from (\d+.\d+.\d+.\d+). -desc=PIX $1 Denied Manager from $2 -action=create nmg_$1; add nmg_$1 %t; add nmg_$1 %s; add nmg_$1 $0; report nmg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete nmg_$1 - -# FIXME -- Add log code FWSM -type=Single -continue=takenext -ptype=RegExp -pattern==^PIXLOG (\S+)\^ .*Denied SSH session from (\d+.\d+.\d+.\d+) on interface.* -desc=PIX $1 Denied SSH from $2 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 %s; add ssh_$1 $0; report ssh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ssh_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Permitted manager connection from (IP_addar). -desc=PIX $1 Allowed Manager from $2 -action=create ymg_$1; add ymg_$1 %t; add ymg_$1 %s; add ymg_$1 $0; report ymg_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ymg_$1 - -# FIXME -# SET \d+.\d+.\d+.\d+ TO ! 128.135.0.x -#type=Single -#continue=takenext -#ptype=RegExp -#pattern=^PIXLOG (\S+)\^ .*Permitted SSH session from (\d+.\d+.\d+.\d+) on interface.*for user "user_id" -#desc=PIX $1 Permitted ssh $3 from $2 -#action=create fsh_$1; add fsh_$1 %t; add fsh_$1 %s; add fsh_$1 $0; report fsh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete fsh_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*SSH login session failed from (\d+.\d+.\d+.\d+) on \((num) attempts\) on interface.*by user "(\S+)" -desc=PIX $1 SSH $3 Failures from $2 by $4 -action=create lsh_$1; add lsh_$1 %t; add lsh_$1 %s; add lsh_$1 $0; report lsh_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lsh_$1 - -# 402101 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*decaps: rec\'d IPSEC packet has invalid spi for destaddr=(\d+.\d+.\d+.\d+).* -desc=PIX $1 IPSEC: Invalid SPI in packet from $2 (possible attack) -action=create spi_$1; add spi_$1 %t; add spi_$1 %s; add spi_$1 $0; report spi_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spi_$1 - -# 402101 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*decapsulate: packet missing (.*), destadr=(\d+.\d+.\d+.\d+) -desc=PIX $1 IPSEC: Packet to $3 did not have type $2 (possible attack) -action=create itp_$1; add itp_$1 %t; add itp_$1 %s; add itp_$1 $0; report itp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete itp_$1 - -# 402103 -# FIXME -- This is messy -#type=Single -#continue=takenext -#ptype=RegExp -#pattern=^PIXLOG (\S+)\^ .*dentity doesn't match negotiated identity \((ip)\) dest_addr= (\d+.\d+.\d+.\d+), src_addr= (\d+.\d+.\d+.\d+), prot= protocol, \((ident)\) local=(\d+.\d+.\d+.\d+), remote=(\d+.\d+.\d+.\d+), local_proxy=(\d+.\d+.\d+.\d+/\d+.\d+.\d+.\d+/port/port), remote_proxy=(\d+.\d+.\d+.\d+/\d+.\d+.\d+.\d+/port/port) -#desc=PIX $1 IPSEC: Peer $2 is attempting to send other packets through us $3 $4 $5 $6 $7 -#action=create per_$1; add per_$1 %t; add per_$1 %s; add per_$1 $0; report per_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete per_$1 - -# 402115 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Received a packet from (\d+.\d+.\d+.\d+) to (\d+.\d+.\d+.\d+) containing.*data instead of.*data. -desc=PIX $1 IPSEC: packet from $2 to $3 doesn't match negotiated proto -action=create ipx_$1; add ipx_$1 %t; add ipx_$1 %s; add ipx_$1 $0; report ipx_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ipx_$1 - -# 402115 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Received an.*packet.*from (\d+.\d+.\d+.\d+).*to (\d+.\d+.\d+.\d+).*The decapsulated inner packet doesn't match the negotiated policy in the SA -desc=PIX $1 IPSEC: packet from $2 to $3 is encapsulated with unexpected data. -action=create enc_$1; add enc_$1 %t; add enc_$1 %s; add enc_$1 $0; report enc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enc_$1 - -# 402118 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Received an.*packet.*from (\d+.\d+.\d+.\d+).*to (\d+.\d+.\d+.\d+) containing an illegal IP fragment.* -desc=PIX $1 IPSEC: packet from $2 to $3 has invalid fragment -action=create enc_$1; add enc_$1 %t; add enc_$1 %s; add enc_$1 $0; report enc_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete enc_$1 - -# 403103 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*PPP virtual interface max connections reached. -desc=PIX $1 PPP interfaces exhausted -action=create pie_$1; add pie_$1 %t; add pie_$1 %s; add pie_$1 $0; report pie_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete pie_$1 - -# 403109 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Rec\'d packet not an PPTP packet. \(.*\) dest_addr= (\d+.\d+.\d+.\d+), src_addr= (\d+.\d+.\d+.\d+).* -desc=PIX $1 Spoofed PPTP Packet from $3 to $2 -action=create spp_$1; add spp_$1 %t; add spp_$1 %s; add spp_$1 $0; report spp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete spp_$1 - -# 404101 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*ISAKMP: Failed to allocate address for client from pool (\S+) -desc=PIX $1 IPSEC: Failed to allocate addr from $2 -action=create faa_$1; add faa_$1 %t; add faa_$1 %s; add faa_$1 $0; report faa_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete faa_$1 - -# 405001 -#type=Single -#continue=takenext -#ptype=RegExp -#pattern=PIXLOG (\S+)\^ .*Received ARP.*collision from (\d+.\d+.\d+.\d+\/....\.....\.....) on.* -#desc=PIX $1 ARP Collision: $2 -#action=create mac_$1; add mac_$1 %t; add mac_$1 %s;add mac_$1 %s; add mac_$1 $0; report mac_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete mac_$1 - -# -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Configuration replication failed for command (\S+) -desc=PIX $1 Failover replication command $2 failed -action=create rcf_$1; add rcf_$1 %t; add rcf_$1 %s; add rcf_$1 $0; report rcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rcf_$1 - -# 709001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*FO replication failed: cmd=(.*) returned=.* -desc=PIX $1 Failover: Command replication failed for Peer: $2 -action=create rcf_$1; add rcf_$1 %t; add rcf_$1 %s; add rcf_$1 $0; report rcf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rcf_$1 - -# 316001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Denied new tunnel to (\d+.\d+.\d+.\d+). VPN peer limit.*exceeded.* -desc=PIX $1 VPN Peer limit exceeded for $2 -action=create plm_$1; add plm_$1 %t; add plm_$1 %s; add plm_$1 $0; report plm_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete plm_$1 - -# 317003 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*IP routing table creation failure - (.*) -desc=PIX $1 Route table Error: $2 -action=create rte_$1; add rte_$1 %t; add rte_$1 %s; add rte_$1 $0; report rte_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rte_$1 - -# 317004 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*IP routing table limit warning -desc=PIX $1 Routing table limit reached -action=create rtl_$1; add rtl_$1 %t; add rtl_$1 %s; add rtl_$1 $0; report rtl_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rtl_$1 - -# 317005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*IP routing table limit exceeded - (.*), (\d+.\d+.\d+.\d+).* -desc=PIX $1 Route table limit breached by $3: $2 -action=create rtb_$1; add rtb_$1 %t; add rtb_$1 %s; add rtb_$1 $0; report rtb_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rtb_$1 - -# 323005 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) can not be powered on completely -desc=PIX $1 Slot $2 will not power on -action=create slp_$1; add slp_$1 %t; add slp_$1 %s; add slp_$1 $0; report slp_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete slp_$1 - -# 411002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Line protocol on interface (\S+) changed state to down -desc=PIX $1 Interface $2 is DOWN! -action=create lpd_$1; add ldp_$1 %t; add ldp_$1 %s; add lpd_$1 $0; report lpd_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete lpd_$1 - -# 412002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Detected bridge table full while inserting MAC (....\.....\.....) on interface .* -desc=PIX $1 MAC Address table is FULL! -action=create brf_$1; add brf_$1 %t; add brf_$1 %s; add brf_$1 $0; report brf_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete brf_$1 - -# 505001 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) is shutting down. Please.* -desc=PIX $1 Slot $2 is shutting down! -action=create sht_$1; add sht_$1 %t; add sht_$1 %s; add sht_$1 $0; report sht_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete sht_$1 - -# 505002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Module in slot (\S+) is reloading. Please.* -desc=PIX $1 Slot $2 is reloading! -action=create rld_$1; add rld_$1 %t; add rld_$1 %s; add rld_$1 $0; report rld_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete rld_$1 - -# 605004 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*Login denied from (.*) to (.*) for user "(\S+)" -desc=PIX $1 Auth Attack from $2 to $3 ($4) -action=create ath_$1; add ath_$1 %t; add ath_$1 %s; add ath_$1 $0; report ath_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ath_$1 -window=10 -thresh=6 - -# 611102 -type=SingleWithThreshold -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*User authentication failed: Uname: (\S+) -desc=PIX $1 Auth Attach from $2 -action=create ath_$1; add ath_$1 %t; add ath_$1 %s; add ath_$1 $0; report ath_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete ath_$1 -window=10 -thresh=6 - -# 615002 -type=Single -continue=takenext -ptype=RegExp -pattern=^PIXLOG (\S+)\^ .*vlan number not available for firewall interface -desc=PIX $1 VLAN Error for FWSM -action=create vln_$1; add vln_$1 %t; add vln_$1 %s; add vln_$1 $0; report vln_$1 /bin/mailx -s "Syslog Watcher [ALERT]" user@example.com; delete vln_$1 - -# diff --git a/pix-security.sec b/pix-security.sec deleted file mode 100644 index 44b19f6..0000000 --- a/pix-security.sec +++ /dev/null @@ -1,246 +0,0 @@ -#################################################################### -# SEC ruleset for Cisco PIX 6.x, 7.x -# -# Copyright (C) 2003-2009 Chris Sawall -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -#################################################################### - -# Process various events from PIX syslog output -# -# Submitted by Chris Sawall -# email: sawall -[at]- gmail -[dot]- com -# Last Updated: 5/20/05 - -# ------------------------------------------------------------------ -# Watch for weird failures - possible trojan/worm -# ------------------------------------------------------------------ - -# Watch for 10 denies within 10 seconds. Especially useful to monitor -# for certain trojans and mass mailers -# -type=SingleWithThreshold -ptype=RegExp -pattern=\s*.*Deny\s+(\w+)\s+src.*:(.*)/.*:(.*)/(\b2\d\b).*$ -desc=Unusual Failures:$1 $4/$2 -> $3 -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 -window=10 -thresh=10 - -# Monitor for occurrances of certain variant of PHEL trojan destined -# for two different class C networks -# -type=Single -continue=dontcont -ptype=RegExp -pattern=(212\.147\.14[12]\.) -desc=Possible PHEL Trojan (1) -action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@example.com; delete phel_$1 - -# ------------------------------------------------------------------ -# Watch for firewall failovers -# ------------------------------------------------------------------ - -# Firewall failures/failovers -# Works for PIX 7.x - -# Failure of secondary (standby) firewall while primary is active -# Works for PIX 7.x -# -# $1 is the IP address of the primary firewall -# -type=Single -continue=takenext -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Primary\).*$ -desc=Secondary firewall for $1 - failure/reload -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 - -# Failure of secondary (standby) firewall while primary is active -# Works for PIX 7.x -# -# $1 is the IP address of the primary firewall -# -type=Single -continue=takenext -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Secondary\).*$ -desc=Primary firewall for $1 - failure/reload -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 - -# Failure of secondary (active), primary assumes active -# Works for PIX 7.x -# -# The first "desc" and "action" don't really do anything here. But SEC requires them to be present. -# $1 is the IP address of the primary firewall -# -type=Pair -continue=dontcont -ptype=RegExp -pattern=PIX-1-102001:\s+\(Primary\).*$ -desc=$0 -action=logonly -ptype2=RegExp -pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Primary\).*Peer state Standby Ready -desc2=Secondary (was active) firewall ($1) has failed. Primary is now active. -action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 -window=5 - -# Failure of primary (active), secondary assumes active -# Works for PIX 7.x -# -# The first "desc" and "action" don't really do anything here. But SEC requires them to be present. -# $1 is the IP address of the primary firewall -# -type=Pair -continue=dontcont -ptype=RegExp -pattern=PIX-1-102001:\s+\(Secondary\).*$ -desc=$0 -action=logonly -ptype2=RegExp -pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Secondary\).*Peer state Standby Ready -desc2=Primary firewall ($1) has failed. Secondary is now active. -action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 -window=5 - -# ------------------------------------------------------------------ -# Watch for firewall reloads -# ------------------------------------------------------------------ - -# Manual reload of PIX -# Works for PIX 6.x -# -# $1 is the IP address of the primary firewall -# -type=Single -continue=dontcont -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX reload.*$ -desc=$1 has been manually rebooted -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com ; delete ffo_$1 - -# Manual reload of PIX -# Works for PIX 7.x -# -# $1 is the IP address of the primary firewall -# -type=Single -continue=dontcont -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Orderly reload.*Reload reason:\s(\S+) -desc=$1 has been manually rebooted, reason: $2 -action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1 - -# ------------------------------------------------------------------ -# Watch for SSH logins/failures on firewalls -# ------------------------------------------------------------------ - -# Suppress emails concerning pixbkup account -# In this case, the pixbkup acct is used to backup the PIX firewalls -# Keeping email alerts to a minimum, this skips past these alerts -# -type=Suppress -continue=dontcont -ptype=RegExp -pattern=pixbkup - -# Successful Admin SSH session -# Works for PIX 6.x -# -# Monitor for successful SSH connections to the PIX firewall -# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr -# -type=Single -continue=dontcont -ptype=RegExp -pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'.*to\s(\d+\.\d+\.\d+\.\d+)\/0.*SSH -desc=Admin Auth to $1.$2 -> $3 from $4 -action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# Successful Admin SSH session -# Works for PIX 7.x -# -# Monitor for successful SSH connections to the PIX firewall -# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr -# -type=Single -continue=dontcont -ptype=RegExp -pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'\sfrom\s(\d+\.\d+\.\d+\.\d+)\/0.*/22.*$ -desc=Admin Auth to $1.$2 -> $3 from $4 -action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# Failed Admin SSH session -# Works for PIX 6.x -# -# Monitor for failed SSH attempts to the PIX firewalls -# $1 is the user acct -# -type=Single -continue=takenext -ptype=RegExp -pattern=Authentication failed.*\'(\S+)\'.*SSH -desc=Admin Auth FAILED -> $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# Failed Admin SSH session -# Works for PIX 7.x -# -# Monitor for failed SSH attempts to the PIX firewalls -# $1 is the user acct -# -type=Single -continue=takenext -ptype=RegExp -pattern=Authentication failed.*\'(\S+)\'.*/22.*$ -desc=Admin Auth FAILED -> $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# Normal SSH termination -# Works for both PIX 6.x and 7.x -# -# $1 is the IP of the firewall and $2 is the user acct -# -type=Single -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*\"(\S+)\".*terminated normally -desc=ADMIN END $1 -> $2 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# SSH session timeout or abnormal termination -# Works for PIX 6.x -# May work for PIX 7.x - not tested but PIX-6-315011 is the same for 6 and 7. -# -# $1 is the IP of the firewall -# -type=Single -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*disconnected by SSH server -desc=Firewall session END - timeout $1 -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# ------------------------------------------------------------------ -# Watch for firewall commands -# ------------------------------------------------------------------ - -# Admin executed "write mem" -# Works for both PIX 6.x and 7.x -# -# $1 is the IP of the firewall -type=Single -ptype=RegExp -pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*write\sm.* -desc=User wrote config to memory -> $1 -action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1 - -# Watch for HIGH CPU Utilization -# Works for PIX 6.x -# -type=Single -ptype=RegExp -pattern=PIX-.-211003 -desc=HIGH CPU Utilization -action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1 - diff --git a/pix-url.sec b/pix-url.sec deleted file mode 100644 index a6e9879..0000000 --- a/pix-url.sec +++ /dev/null @@ -1,80 +0,0 @@ -#################################################################### -# SEC ruleset for Monitoring Keywords -# -# Copyright (C) 2003-2009 Chris Sawall -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -#################################################################### - -# This particular ruleset was designed to monitor PIX syslog traffic -# and watch for keywords in URL traffic. Starting SEC must include -# the -intevents option. -# -# Currently tested for PIX 6.x -# -# Submitted by Chris Sawall -# email: sawall -[at]- gmail -[dot]- com -# Last Updated: 5/20/05 - -# Wait for SEC to start up or be restarted and then read in two lists -# of words. The first being a list of words to watch for and alert on, -# the second list being a list of exclusions for a suppression rule. -# -type=Single -ptype=PerlFunc -pattern=sub { if(($_[0] eq "SEC_STARTUP") || ($_[0] eq "SEC_RESTART")) { @words=`cat /root/watch4badwords`; chomp(@words); $list=join('|', @words); @ewords=`cat /root/watch4excludes`; chomp(@ewords); $excludes=join('|', @ewords);} } -desc=$0 -context=SEC_INTERNAL_EVENT -action=write - Set word list variable; - -# ------------------------------------------------------------------ -# Scan for certain URLs -# ------------------------------------------------------------------ - -# Monitor and match on keywords from the exclusions file and -# suppress reporting on them. -# -type=Suppress -continue=dontcont -ptype=PerlFunc -pattern=sub {($_[0] =~ /($excludes)/) } - -# Monitor for keywords and send an email alert -# -type=Single -ptype=PerlFunc -pattern=sub {($_[0] =~ /($list)/) } -desc=Inappropriate word in URL -action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1 - -# -# Examples of "watch4badwords" and "watch4excludes" -# -# File should be a return delimited file. The -# script read the file in literally and creates -# an OR statement by putting a pipe (|) between -# all of the keywords. -# -# Be careful on what words are being monitored. -# The word virgin also finds virginia and alerts -# on it. -# -# The following are examples of things that work: -# -# ----> watch4badwords -# -# \bvirgin\b -# \byoung girl\b -# \b[Pp]layboy\b -# pr0n -# hardcore -# -# ----> watch4excludes -# -# \b10\.10\.2\.4\b -# \bcherry tree\b -# cnn.com -# - - diff --git a/portscan.sec b/portscan.sec deleted file mode 100644 index 1b2effe..0000000 --- a/portscan.sec +++ /dev/null @@ -1,45 +0,0 @@ -################################################################ -# Sample SEC ruleset for "PORTSCAN FROM ip1 TO ip2:port" events -# -# Copyright (C) 2003-2009 Risto Vaarandi -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -################################################################ - -# process "PORTSCAN FROM ip1 TO ip2:port" events, and if a certain -# source host has scanned the same destination port on more than -# 10 distinct destination hosts during 60 seconds, raise an alarm - -type=Single -ptype=RegExp -pattern=PORTSCAN FROM (\S+) TO \S+:(\d+) -context=!HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 -continue=TakeNext -desc=Horizontal port sweep started from source $1 to target port $2 -action=eval %o ( $portscans{"$1:$2"} = {} ); \ - create HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 60 \ - eval %o ( delete $portscans{"$1:$2"} ) - -type=Single -ptype=RegExp -pattern=PORTSCAN FROM (\S+) TO (\S+):(\d+) -context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 -continue=TakeNext -desc=Scanned destination IP: $2 -action=eval %o ( $portscans{"$1:$3"}->{$2} = 1 ); \ - add HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 %t: %s;\ - set HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 60 \ - eval %o ( delete $portscans{"$1:$3"} ) - -type=Single -ptype=RegExp -pattern=PORTSCAN FROM (\S+) TO (\S+):(\d+) -context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ - && =( scalar(keys(%{$portscans{"$1:$3"}})) > 10 ) -continue=DontCont -desc=$1 has scanned more than 10 destinations -action=report HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \ - mail -s 'Horizontal port sweep from $1 target port $3' root@example.com; \ - delete HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3; \ - eval %o ( delete $portscans{"$1:$3"} ) diff --git a/sec.spec b/sec.spec index 218cc05..59db8fa 100644 --- a/sec.spec +++ b/sec.spec @@ -1,37 +1,15 @@ Name: sec -Version: 2.8.1 -Release: 0%{?dist} +Version: 2.8.2 +Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons License: GPLv2+ -URL: http://simple-evcorr.github.io/ -Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz +URL: https://simple-evcorr.github.io/ +Source0: https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz Source1: sec.sysconfig Source2: sec.init Source3: sec.logrotate -# Example files and configuration info Source4: conf.README -Source5: http://simple-evcorr.sourceforge.net/rulesets/amavisd.sec -Source6: http://simple-evcorr.sourceforge.net/rulesets/bsd-MONITOR.sec -Source7: http://simple-evcorr.sourceforge.net/rulesets/bsd-PHYSMOD.sec -Source8: http://simple-evcorr.sourceforge.net/rulesets/bsd-USERACT.sec -Source9: http://simple-evcorr.sourceforge.net/rulesets/bsd-general.sec -Source10: http://simple-evcorr.sourceforge.net/rulesets/bsd-mpd.sec -Source11: http://simple-evcorr.sourceforge.net/rulesets/cisco-syslog.sec -Source12: http://simple-evcorr.sourceforge.net/rulesets/cvs.sec -Source13: http://simple-evcorr.sourceforge.net/rulesets/dameware.sec -Source14: http://simple-evcorr.sourceforge.net/rulesets/hp-openview.sec -Source15: http://simple-evcorr.sourceforge.net/rulesets/labrea.sec -Source16: http://simple-evcorr.sourceforge.net/rulesets/pix-general.sec -Source17: http://simple-evcorr.sourceforge.net/rulesets/pix-security.sec -Source18: http://simple-evcorr.sourceforge.net/rulesets/pix-url.sec -Source19: http://simple-evcorr.sourceforge.net/rulesets/portscan.sec -Source20: http://simple-evcorr.sourceforge.net/rulesets/snort.sec -Source21: http://simple-evcorr.sourceforge.net/rulesets/snortsam.sec -Source22: http://simple-evcorr.sourceforge.net/rulesets/ssh-brute.sec -Source23: http://simple-evcorr.sourceforge.net/rulesets/ssh.sec -Source24: http://simple-evcorr.sourceforge.net/rulesets/vtund.sec -Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec BuildArch: noarch # The init script uses arrays, so we need bash @@ -62,16 +40,7 @@ install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1 install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/sec install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec install -D -m 0755 -p %{SOURCE2} %{buildroot}%{_initrddir}/sec - -# Install the example config files and readme install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README -install -d -m 0755 examples -install -m 0644 -p %{SOURCE5} %{SOURCE6} %{SOURCE7} %{SOURCE8} \ - %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} \ - %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} \ - %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} \ - %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} \ - %{SOURCE25} examples/ # Remove executable bits because these files get packed as docs chmod 0644 contrib/convert.pl contrib/swatch2sec.pl @@ -97,7 +66,7 @@ rm -rf %{buildroot} %files %defattr(-,root,root,-) -%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples +%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl %config(noreplace) %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/sysconfig/sec %config(noreplace) %{_sysconfdir}/logrotate.d/sec @@ -106,6 +75,10 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Mon Jun 3 2019 Stefan Schulze Frielinghaus - 2.8.2-1 +- New upstream release +- Clean up spec file + * Wed Oct 3 2018 Stefan Schulze Frielinghaus - 2.8.1-0 - New upstream release diff --git a/snort.sec b/snort.sec deleted file mode 100644 index 9cfe1ae..0000000 --- a/snort.sec +++ /dev/null @@ -1,163 +0,0 @@ -#################################################################### -# Sample SEC ruleset for Snort IDS -# -# Copyright (C) 2003-2009 Risto Vaarandi -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -#################################################################### - -# ------------------------------------------------------------------ -# Handle portscans -# ------------------------------------------------------------------ - -# For every completed portscan, add an entry to the PORTSCAN_REPORT; -# also generate a meta-event ACTIVITY_FROM for the IP - -type=Single -ptype=RegExp -pattern=End of portscan from (([\d\.]+).*) -desc=Portscan from $1 -action=add PORTSCAN_REPORT %t: %s; event ACTIVITY_FROM_$2: %s - - -# ------------------------------------------------------------------ -# Recognize snort alert message and generate corresponding SEC event -# ------------------------------------------------------------------ - -# recognize snort alert message; also generate -# a meta-event ACTIVITY_FROM for the IP - -type=Single -ptype=RegExp -pattern=snort(?:\[\d+\])?: \[[0-9:]+\] (.+|!Malware|!MALWARE) \[(.+)\] \[.*Priority: (\d+)\]: \S+ ([\d\.]+):?\d* -> ([\d\.]+):?\d* -desc=PRIORITY $3 INCIDENT FROM $4 TO $5: $1 [$2] -action=event %s; event ACTIVITY_FROM_$4: $1 - - -## Detect if it's an unwanted event in snort -#type=Single -#ptype=RegExp -#pattern=(MALWARE|Malware) -#desc=$0 -#action=create UNWANTED_EVENT - - -# ------------------------------------------------------------------ -# Handle priority 1 incidents -# ------------------------------------------------------------------ - -# Detect the beginning of priority 1 attack from a certain source IP, -# and send a warning e-mail message that a new attack has begun; -# also create a context for storing a detailed information about the attack - -type=Single -ptype=RegExp -pattern=PRIORITY 1 INCIDENT FROM (\S+) TO \S+: .+ -context=ATTACK_FROM_$1 -continue=TakeNext -desc=Priority 1 attack started from $1 -action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' \ - /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1' alerts@example.com - - -# For every priority 1 incident, add an entry to the context by its IP; -# if the IP has been quiet for 5 minutes, report the whole attack - -type=Single -ptype=RegExp -pattern=PRIORITY 1 INCIDENT FROM (\S+) TO (\S+): (.+) -context=ATTACK_FROM_$1 -continue=TakeNext -desc=Priority 1 incident from $1 to $2: $3 -action=add ATTACK_FROM_$1 %t: %s; \ - set ATTACK_FROM_$1 300 ( report ATTACK_FROM_$1 \ - /usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@example.com ) - - -# ------------------------------------------------------------------ -# Handle incidents by thresholding -# ------------------------------------------------------------------ - -# Count how many _certain type_ of incidents are coming from one source -# if the threshold has been crossed, reset the counting operation started -# by the next rule, in order to avoid duplicate alerts for the same IP - -type=SingleWithThreshold -ptype=RegExp -pattern=PRIORITY (\d+) INCIDENT FROM (\S+) TO \S+: (.+) -continue=TakeNext -desc=Snort has seen >= 30 priority $1 incidents from $2: $3 -action=add ALERT_REPORT %t: %s; \ - reset +1 Snort has seen >= 150 incidents from $2; \ - create TURNOFF_$2 3600 -thresh=30 -window=3600 - - -# Count how many incidents come from one source - -type=SingleWithThreshold -ptype=RegExp -pattern=PRIORITY \d+ INCIDENT FROM (\S+) TO \S+: .+ -context=!TURNOFF_$1 -desc=Snort has seen >= 150 incidents from $1 -action=add ALERT_REPORT %t: %s -thresh=150 -window=7200 - - -# ------------------------------------------------------------------ -# Report IPs that have been active for some time -# ------------------------------------------------------------------ - -# Set up activity contexts for the IP; if the IP has been active for 2 hours, -# and there have been no gaps longer than 30 minutes, report its activities - -type=Single -ptype=RegExp -pattern=ACTIVITY_FROM_(\S+): -context=!ACTIVITY_LIST_FOR_$1 -continue=TakeNext -desc=Create activity contexts for $1 -action=create ACTIVITY_LIST_FOR_$1_LIFETIME; \ - create ACTIVITY_LIST_FOR_$1 7200 ( report ACTIVITY_LIST_FOR_$1 \ - /usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@example.com; \ - delete ACTIVITY_LIST_FOR_$1_LIFETIME ) - - -# Add the activity event to the context of a given IP, and extend -# the lifetime of activity contexts for 30 minutes for the IP - -type=Single -ptype=RegExp -pattern=ACTIVITY_FROM_(\S+): (.*) -context=ACTIVITY_LIST_FOR_$1 -desc=Activity from $1: $2 -action=add ACTIVITY_LIST_FOR_$1 %t: %s; \ - set ACTIVITY_LIST_FOR_$1_LIFETIME 1800 ( delete ACTIVITY_LIST_FOR_$1 ) - - -# ------------------------------------------------------------------ -# Send reports every day at 9:00 am -# ------------------------------------------------------------------ - -# send daily report about regular alerts - -type=Calendar -time=0 12 * * * -desc=Sending alert report... -action=report ALERT_REPORT \ - /usr/bin/mail -s 'SNORT: Hourly alert report' alerts@example.com; \ - delete ALERT_REPORT - - -# send daily report about portscans - -type=Calendar -time=0 9 * * * -desc=Sending portscan report... -action=report PORTSCAN_REPORT \ - /usr/bin/mail -s 'SNORT: daily portscan report' alerts@example.com; \ - delete PORTSCAN_REPORT - diff --git a/snortsam.sec b/snortsam.sec deleted file mode 100644 index 05aa074..0000000 --- a/snortsam.sec +++ /dev/null @@ -1,77 +0,0 @@ -############################################################################# -# Snort SAM events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Error: Could not bind socket. -desc = $0 -action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@example.com - - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*), email, Error: \[email\] Did not receive a response waiting for banner on mail server at (.*) -desc = $0 -action=add SNORTSAM_REPORT $1 Couldn't email through $3 : %s - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) snortsam, Extending block for host ([A-z._0-9-]*) completely for (.*) -desc = $0 -action=add SNORTSAM_REPORT $1 Extending Block for $3 for $4 - - -#type=single -#ptype=regexp -#pattern=([A-Za-z0-9._-]+)snortsam\[([0-9]+)\]: [*], [:0-9]+, -, ipf, (.*) Failed -#desc = Snortsam ipf error -#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@example.com -##action=add SNORTSAM_REPORT ERROR $1 IPF Command Failure: $2 - - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Starting to listen for Snort alerts. -desc = $0 -action=add SNORTSAM_REPORT $1 Snortsam Startup: %s - - -#type=single -#ptype=regexp -#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Removing (.*) complete block for host (.*). -#desc = $0 -#action=add SNORTSAM_REPORT $1 Snortsam Removing Block: %s - -#type=single -#ptype=regexp -#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Blocking host (.*) completely for (.*) \((Sig_ID: \d+\))\. -#desc = $0 -#action=add SNORTSAM_REPORT $1 Snortsam Block: %s - - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*) ipf, Error: Command (.*) Failed -desc = $0 -action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@example.com - -type=single -ptype=regexp -pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Snortsam Station .* using wrong password, trying to resync. -desc = $0 -action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@example.com - -#Send hourly snortsam report - -type=Calendar -time=0 * * * * -desc=Sending snortsam report... -action=report SNORTSAM_REPORT \ - /usr/bin/mail -s 'SNORTSAM report' alerts@example.com; \ - delete SNORTSAM_REPORT diff --git a/sources b/sources index d3e3552..2347df8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.8.1.tar.gz) = 03c7acd1e1cfd6dc11143e0ff35758925ddc75e460987a91d5606564f0caa45afade497b8653ec2d8865cfcfab4d87743777eb104e1a16f79069cf61e17d0661 +SHA512 (sec-2.8.2.tar.gz) = 846a0671d5d774f74645e5e4f6d7a01c04079be19ea9b2ec9cb862fb48173dac0e1131981bb6e1fae525c74610dfdabc1535ff5818ae893bec35daab46e05c07 diff --git a/ssh-brute.sec b/ssh-brute.sec deleted file mode 100644 index f993507..0000000 --- a/ssh-brute.sec +++ /dev/null @@ -1,69 +0,0 @@ -################## ssh brute force attack blocker -# Copyright (C) 2003-2009 Mark Bergman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -################## -# -# This sec ruleset monitors syslog messages for indications that an ssh brute-force -# login attack is underway. The trigger is an ssh login failure. -# -# If 4 additional syslog messages about ssh login failures from the same -# source address are received within next 1 minute, an iptables firewall -# rule is added to block access from the source IP. -# -# After that, the correlation operation waits until no ssh login failure -# syslog messages from the source IP have been received from the router -# during the last 2 hours, and then the iptables rule is removed. By -# definition, once the IP is blocked, there will be no more connection -# attempt failures logged by ssh (ie., packets will be dropped by the kernel -# before they reach the syslog daemon), so the rule will be flushed after -# 2 hours. -# -# Vulnerabilities of this ruleset are: -# -# persistent firewall rules: -# if the sec daemon crashes or is restarted, any existing rules -# will not be removed after 2hours -# -# window=60 # sliding window (1 minute) for initial event match -# thresh=4 # number of events (ssh login failures from a given IP) that must -# # occur within the window period in order to trigger the action -# -# window2=7200 # sliding window (2 hours) for the second event match -# thresh2=0 -############### -# RCSversion="$Header: /home/fedora/jkeating/pkgs/rpms/sec/EL-6/ssh-brute.sec,v 1.2 2009/10/03 07:52:15 stefansf Exp $" -# -# Representative log file entries: -# Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp -# Aug 28 04:43:03 host sshd[22568]: Failed password for illegal user library from 210.230.187.218 port 55019 ssh2 -# Aug 28 04:42:28 www.somehost.net sshd[9395]: Failed password for illegal user mysql from 210.230.187.218 port 52857 ssh2 -# Aug 28 04:42:28 host sshd[22509]: Failed password for root from 210.230.187.218 port 52960 ssh2 -# Aug 28 04:42:32 www.somehost.net sshd[9397]: Failed password for illegal user oracle from 210.230.187.218 port 53212 ssh2 -# Aug 28 04:42:32 host sshd[22510]: Failed password for illegal user admin from 2 10.230.187.218 port 53243 ssh2 - -# -type=SingleWith2Thresholds -ptype=RegExp -pattern=sshd.*: authentication failure[ ;].* rhost=(\S+) -desc=Multiple failed ssh authentication attempts from $1 -action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP ) -window=60 -thresh=4 -desc2=Pruning iptables firewall rule blocking ssh from $1 -action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ) -window2=7200 -thresh2=0 - -type=SingleWith2Thresholds -ptype=RegExp -pattern=sshd.*: Failed password for.* user .* from (\S+) -desc=Multiple ssh password failures from $1 -action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP ) -window=60 -thresh=4 -desc2=Pruning iptables firewall rule blocking ssh from $1 -action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; sleep 2; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ; sleep 2) -window2=7200 -thresh2=0 diff --git a/ssh.sec b/ssh.sec deleted file mode 100644 index d9704e9..0000000 --- a/ssh.sec +++ /dev/null @@ -1,260 +0,0 @@ -########################################################################### -# SEC ruleset to accumulate errors from a parent and child sshd process -# into a single context. This allows reporting of the authenticated -# user information with the error's generated by the child sshd process. -# -# Copyright (C) 2003-2009 John P. Rouillard -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -########################################################################### - -# note handling of deferred reporting until after tie events received -# is still in flux. My old rules hanlded it by resubmitting all the -# events, but it didn't handle the parent defered reporting -# events. This way is cleaner, but not tested very well. - -type=single -continue=dontcont -ptype=Nregexp -pattern=sshd|SSHD -desc=filter out non-sshd events -action=none - -type=single -continue=dontcont -ptype=TValue -pattern=TRUE -desc=guard for already handled -action=logonly -context = [EVENT_PROCESSED] - -type=single -continue=takenext -ptype=TValue -pattern=TRUE -desc=We will handle. -action=create EVENT_PROCESSED - -## Recognize the start of an ssh session -# link parent and child event contexts. -# -#type=PairWithWindow -#continue=takenext -#desc=Recognize ssh session start for $1[$2] -#ptype=regexp -#pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Connection from ([0-9.]+) port [0-9]+ -#action=pipe session_log_$1_$2 \ -# /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@example.com -#desc2=Link parent and child contexts -#ptype2=regexp -#pattern2=$1 [A-z0-9]+\[[0-9]+\]: \[[^]]+\] SSHD child process +([0-9]+) spawned by $2 -#action2=copy session_log_%1_$1 %b; \ -# delete session_log_%1_$1; \ -# alias session_log_%1_%2 session_log_%1_$1; \ -# add session_log_%1_$1 $0; \ -# event 0 "sshd: Report %1_$1 if needed"; \ -# alias session_log_owner_%1_%2 session_log_owner_%1_$1 ;\ -# create tie_event_received_%1_%2 ;\ -# alias tie_event_received_%1_%2 tie_event_received_%1_$1 ;\ -# delete ssh_tie_event_needed_%1 -#window=60 - -## recognize login event and save username for later use -type=single -desc=Start login timer -ptype=regexp -pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Accepted (publickey|password) for ([A-z0-9_-]+) from [0-9.]+ port [0-9]+ (.*) -action=add session_log_$1_$2 $0; add session_log_owner_$1_$2 $4 - -# handle logout -type=single -desc=Recognize ssh session end -ptype=regexp -pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Closing connection to ([0-9.]+) -action= delete session_log_$1_$2; delete session_log_owner_$1_$2; \ - delete tie_event_received_$1_$2 - -## ignore ssh IPV6 errors. -# -# Example input: -# Nov 3 06:34:25 corphost sshd[5961]: [ID 800047 auth.error] error: \ -# connect_to ::1 port 5910: Network is unreachable -# -type=suppress -desc = ignore IPV6 errors from ssh -ptype=regexp -pattern=sshd\[[0-9]+\]: \[ID 800047 auth.error\] error: connect_to ::1 port [0-9]+: Network is unreachable - -# because the tie command can come after critical errors are reported, -# we provide a way to generate a report on demand. -type=single -desc=Report immediate on request. -ptype=regexp -pattern=^sshd: Report (.*) if needed$ -context = session_log_report_$1 -action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@example.com ;\ - delete session_log_report_$1 - -type=suppress -desc=Discard report immediate event on request. -ptype=regexp -pattern=^sshd: Report (.*) if needed$ - -# INSERT IMMEDIATE REPORT RULES HERE -# rules that should report problems immediately should go here. -# e.g. channel_setup_fwd_listener: cannot listen to port: 1521 -# where port is < 1024, or is some other well known port indicating -# possible hacking. -# -# We have five possible cases: -# Event is from parent process and no info from child process is needed. -# Report normally. -# Event is from parent process and info from child process is needed, -# and tie event received (context tie_event_received__ -# exists). Report normally. -# Event is from parent process and info from child process is needed, -# but tie event not received (context tie_event_received__ -# does not exist). -# Report using child event as trigger. -# Event that has to be reported is from the child process and -# we have received the tie event (context -# tie_event_received__ exists). Just report normally. -# Event that has to be reported is from the child process and -# we haven't received the tie event (context -# tie_event_received__ does not exist). Defer reporting -# until after tie event by setting context -# session_log_report__. -# -# We may need two rules for each event if the event can come before the tie -# event. One rule checks to see if the context ssh_tie_event_needed_$1 -# where $1 is the reporting host. If so then it needs to set the context -# session_log_report__ if generated by the child process. - -# Note we get a less specific report this way. It should be retooled -# to generate a context that the report rule can simply obsolete. -# These events are generated by the child. -type=single -continue=takenext -desc = record ssh channel_setup_fwd_listener error for $1 port < 1025 -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*) -context = $3 < 1025 && ! tie_event_received_$1_$2 -action = add session_log_$1_$2 $0 ; \ - create session_log_report_$1_$2 - -type=single -continue=takenext -desc = record ssh channel_setup_fwd_listener error for $1 port < 1025 -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*) -context = $3 < 1025 && tie_event_received_$1_$2 -action = add session_log_$1_$2 $0 ; \ - report session_log_report_$1_$2 \ - /usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@example.com - -# end immediate rules here - -## report/record ssh bind errors. -# Record ssh bind errors in the session log. Don't report unless -# we have more than 5 of them in a 10 minute period. Then go and -# find out why they are occurring. Probably a frustrated user -# getting the -L options wrong. -# -# We record all events until a 10 minute period has passed with no -# events. If the threshold is exceeded, then we report all events -# recorded during the 10 minute rolling window. -# -# We also group channel_setup_fwd_listener with this. -# -# Example input: -# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: bind: \ -# Address already in use -# -type=single -continue=takenext -desc = record ssh bind error for $1 -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use -action = add session_log_$1_$2 $0 ; \ - set ssh_port_forward_errors_$1_$2 600 - -type=singlewiththreshold -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use -context = ssh_port_forward_errors_$1_$2 -desc = send report on ssh forward errors if pass threshold (bind) -action = report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com; \ - delete ssh_port_forward_errors_$1_$2 -thresh=5 -window=600 - -# Similar idea to ssh bind errors except on -# channel_setup_fwd_listener errors. If we have more than 5 -# of them in a 10 minute period, go and find out why they are occurring. -# Probably a frustrated user getting the -L options wrong. -# -# We record all events until a 10 minute period has passed with no -# events. If the threshold is exceeded, then we report all events -# recorded during the 10 minute rolling window. -# -# Example input: -# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: \ -# channel_setup_fwd_listener: cannot listen to port: 1521 -# - -type=single -continue=takenext -desc = record ssh channel_setup_fwd_listener error for $1 -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: -action = add session_log_$1_$2 $0 ; \ - set ssh_channel_setup_errors_$1_$2 600 - -type=singlewiththreshold -ptype=regexp -pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: -context = ssh_channel_setup_errors_$1_$2 -desc = send report on ssh channel setup errors -action = report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com ; \ - delete ssh_channel_setup_errors_$1_$2 -thresh=5 -window=600 - -# Gather random sshd errors and report after 5 minutes -# -# This could have been set up a number of different ways, but I have one -# rule to create the context only when it doesn't exist, and another rule -# that adds to the context. The create rule also sets the 5 minute timeout -# that will cause the event store to be delivered when it is deleted. -# -# Example input: -# Nov 3 09:48:56 example sshd[7871]: [ID 800047 auth.crit] fatal: \ -# Timeout before authentication for 37.117.12.201 -# -type=single -continue = takenext -ptype=regexp -pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: -desc = create context to report ssh errors for host $1 pid $2 in 5 minutes -context = ! session_log_5min_timer_$1_$2 -action = create session_log_5min_timer_$1_$2 300 report session_log_$1_$2 \ - /usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@example.com - -type=single -continue = dontcont -ptype=regexp -pattern=([A-Za-z0-9._-]*) sshd\[([0-9]+)\]: -desc = gather ssh errors for host $1 -action = add session_log_$1_$2 $0 - -# Remove the handled context if we reach this point. -type=single -continue=dontcont -ptype=TValue -pattern=TRUE -desc=delete EVENT_PROCESSED -action=delete EVENT_PROCESSED - diff --git a/vtund.sec b/vtund.sec deleted file mode 100644 index 1bc167f..0000000 --- a/vtund.sec +++ /dev/null @@ -1,67 +0,0 @@ -############################################################################# -# VTUN events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (\S+)\[\S\] opened -desc=$0 -action=add GENERAL_REPORT %t: %s; - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: BlowFish encryption initialized -desc=$0 -action=add GENERAL_REPORT %t: VTUN Tunnel Opened on $1 - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: VTun client ver\s+(.*) -desc=$0 -action=add GENERAL_REPORT %t: VTUN Server Started on $1 version $2 - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connecting to (.*) -desc=$0 -action=add GENERAL_REPORT VTUN %s - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Denied connection from (\d+\.\d+\.\d+\.\d+):\d+ -desc=$0 -action=add GENERAL_REPORT %t: VTUN Connection DENIED by $1 from $2 - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connection denied by (.*) -desc=$0 -action=add GENERAL_REPORT %t: VTUN Connection DENIED by $2 for $1 - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Exit -desc=$0 -action=add GENERAL_REPORT %t: VTUN Exit on $1 - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Can't resolv server address: (.*) -desc=$0 -action=add GENERAL_REPORT %t: VTUN Cannot Resolve Target $2 on $1 - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (/S+) closed -desc=$0 -action=add GENERAL_REPORT %t: VTUN Session $2 Closed on $1 - diff --git a/windows.sec b/windows.sec deleted file mode 100644 index 9e63e3c..0000000 --- a/windows.sec +++ /dev/null @@ -1,44 +0,0 @@ -############################################################################# -# Windows events -# -# Copyright (C) 2003-2009 Matt Jonkman -# This is free software. You may redistribute copies of it under the terms of -# the GNU General Public License version 2. -# There is NO WARRANTY, to the extent permitted by law. -############################################################################# - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+ESE: N/A: Information Store \(\d+\) Online defragmentation (.*) -desc=$0 -action=add GENERAL_REPORT EXCHANGE DEFRAG%t: %s; - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Userenv: NT AUTHORITY\\SYSTEM: Windows cannot determine the user or computer name\. Return value \(1326\). -desc=$0 -action=add GENERAL_REPORT %t: %s - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Locked Out: Target Account Name: (\S+) .* -desc=$0 -action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@example.com - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Changed: (/S+)\. .* -desc=$0 -action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@example.com - - -type=Single -ptype=RegExp -pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+NetBT: N\/A: A duplicate name has been detected on the TCP network\. .* -desc=$0 -action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@example.com - - - From 62b75af71773119dec7da8c0f92681a01dffb146 Mon Sep 17 00:00:00 2001 From: Stefan Schulze Frielinghaus Date: Sat, 2 May 2020 20:53:03 +0200 Subject: [PATCH 32/32] New upstream release --- .gitignore | 1 + sec.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 10f38ca..e36137e 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ sec-2.5.3.tar.gz /sec-2.8.0.tar.gz /sec-2.8.1.tar.gz /sec-2.8.2.tar.gz +/sec-2.8.3.tar.gz diff --git a/sec.spec b/sec.spec index 59db8fa..4191272 100644 --- a/sec.spec +++ b/sec.spec @@ -1,5 +1,5 @@ Name: sec -Version: 2.8.2 +Version: 2.8.3 Release: 1%{?dist} Summary: Simple Event Correlator script to filter log file entries Group: System Environment/Daemons @@ -75,6 +75,9 @@ rm -rf %{buildroot} %{_mandir}/man1/sec.1* %changelog +* Sat May 2 2020 Stefan Schulze Frielinghaus - 2.8.3-1 +- New upstream release + * Mon Jun 3 2019 Stefan Schulze Frielinghaus - 2.8.2-1 - New upstream release - Clean up spec file diff --git a/sources b/sources index 2347df8..e30ca73 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sec-2.8.2.tar.gz) = 846a0671d5d774f74645e5e4f6d7a01c04079be19ea9b2ec9cb862fb48173dac0e1131981bb6e1fae525c74610dfdabc1535ff5818ae893bec35daab46e05c07 +SHA512 (sec-2.8.3.tar.gz) = 9eba7db0dfa3661a3ef4e8aad3eeef1db710784f7a71131991a06918cc4f5634577b8bff3f00fcc1c5d998bf0c1e80efe88e1c1df3f5530b6ab4905ff00f2269