Compare commits
No commits in common. "rawhide" and "f26" have entirely different histories.
29 changed files with 3403 additions and 142 deletions
10
.gitignore
vendored
10
.gitignore
vendored
|
|
@ -13,13 +13,3 @@ sec-2.5.3.tar.gz
|
|||
/sec-2.7.9.tar.gz
|
||||
/sec-2.7.10.tar.gz
|
||||
/sec-2.7.11.tar.gz
|
||||
/sec-2.7.12.tar.gz
|
||||
/sec-2.8.0.tar.gz
|
||||
/sec-2.8.1.tar.gz
|
||||
/sec-2.8.2.tar.gz
|
||||
/sec-2.8.3.tar.gz
|
||||
/sec-2.9.0.tar.gz
|
||||
/sec-2.9.1.tar.gz
|
||||
/sec-2.9.2.tar.gz
|
||||
/sec-2.9.3.tar.gz
|
||||
/sec-2.9.4.tar.gz
|
||||
|
|
|
|||
24
amavisd.sec
Normal file
24
amavisd.sec
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
#############################################################################
|
||||
# Amavisd events
|
||||
#
|
||||
# Copyright (C) 2003-2009 Matt Jonkman
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#############################################################################
|
||||
|
||||
#Sep 4 15:43:02 xxxxx clamd[581]: /var/amavisd/amavis-20050904T153955-46858/parts/part-00001: HTML.Phishing.Bank-1 FOUND
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+clamd\[\d+\]: .*amavis-200\d+.*: (.*) FOUND
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT CLAMD: $2 on $1
|
||||
|
||||
#Sep 4 00:02:46 xxxxx amavis[57825]: (57825-12) TROUBLE in check_mail: creating_partsdir FAILED: DBD::mysql::st execute failed: L
|
||||
ost connection to MySQL server during query at (eval 53) line 238, <GEN7> line 1789.
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+amavis\[\d+\]: .* TROUBLE .*
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT AMAVISD: $1: %s
|
||||
|
||||
59
bsd-MONITOR.sec
Normal file
59
bsd-MONITOR.sec
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
#
|
||||
# SEC rules to pick up disruptive monitoring
|
||||
# events.
|
||||
#
|
||||
# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html
|
||||
#
|
||||
# Copyright (C) 2003-2009 Jim Brown
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#
|
||||
#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR)
|
||||
#----------------------------------------------------------------------
|
||||
#Nov 15 20:02:48 foohost syslogd: exiting on signal 15
|
||||
#Nov 22 02:00:02 foohost syslogd: restart
|
||||
#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled
|
||||
#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled
|
||||
#
|
||||
|
||||
#
|
||||
# Syslog Exit
|
||||
# -----------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+)
|
||||
desc=$0
|
||||
action=write - MONITOR: $1 syslog exit on signal $2 at %t
|
||||
|
||||
#
|
||||
# Syslog Restart
|
||||
# ---------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart
|
||||
desc=$0
|
||||
action=write - MONITOR: $1 syslog restart at %t
|
||||
|
||||
#
|
||||
# Syslog Exit
|
||||
# -----------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+)
|
||||
desc=$0
|
||||
action=write - MONITOR: $1 $2 promiscuous mode $3 at %t
|
||||
|
||||
#
|
||||
# Swapspace failure
|
||||
#
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+kernel: swap_pager_getswapspace\(\S\): .*
|
||||
desc=$0
|
||||
action=pipe '$1 GET SWAP FAILURE: %s' /usr/bin/mail -s "SWAP SPACE FAIL on $1" alerts@example.com
|
||||
|
||||
50
bsd-PHYSMOD.sec
Normal file
50
bsd-PHYSMOD.sec
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
#
|
||||
# PHYSMOD.conf - Events concerning physical modifications
|
||||
# to the system.
|
||||
#
|
||||
# from http://sixshooter.v6.thrupoint.net/SEC-examples/article.html
|
||||
#
|
||||
# Copyright (C) 2003-2009 Jim Brown
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#
|
||||
#Logs involving physical modifications (PHYSMOD)
|
||||
#------------------------------------------------
|
||||
#Nov 14 21:11:19 foohost /kernel: pccard: card inserted, slot 0
|
||||
#Nov 14 22:28:09 foohost /kernel: pccard: card removed, slot 0
|
||||
#Nov 12 19:46:31 foohost /kernel: de0: link down: cable problem?
|
||||
#Nov 12 19:46:42 foohost /kernel: de0: autosense failed: cable problem?
|
||||
#Oct 18 06:26:37 foohost pccardd[49]: ep0: 3Com Corporation (/3C589/) inserted.
|
||||
#Oct 18 06:26:42 foohost pccardd[49]: pccardd started
|
||||
#
|
||||
|
||||
#
|
||||
# PCMCIA Card Insertion, Removal
|
||||
# --------------------------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pccard: card (\S+), slot (\d+)
|
||||
desc=$0
|
||||
action=write - PHYSMOD: $1 pccard: card $2 in slot $3 at %t
|
||||
|
||||
#
|
||||
# PCMCIA Card Daemon
|
||||
# --------------------------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+pccardd\[\d+\]: (.*)
|
||||
desc=$0
|
||||
action=write - PHYSMOD: $1 pccardd: $2 at %t
|
||||
|
||||
#
|
||||
# Cabling Problem
|
||||
# ----------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem
|
||||
desc=$0
|
||||
action=write - PHYSMOD: $1 cable problem on $2, text: $3 at %t
|
||||
81
bsd-USERACT.sec
Normal file
81
bsd-USERACT.sec
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
#
|
||||
# Events concerning user activities.
|
||||
#
|
||||
# From http://sixshooter.v6.thrupoint.net/SEC-examples/article.html
|
||||
#
|
||||
# Copyright (C) 2003-2009 Jim Brown
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#
|
||||
#Logs involving logins, change of UID and privilege escalations (USERACT)
|
||||
#-------------------------------------------------------------------------
|
||||
#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1
|
||||
#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100
|
||||
#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for jpb from 192.168.1.1 port 1077 ssh2
|
||||
#Nov 14 12:55:29 foohost sshd[3425]: Accepted keyboard-interactive/pam for jpb from fe80::2c0:4fff:fe18:13fd%ep0 port 27492 ssh2
|
||||
#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2
|
||||
#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql
|
||||
#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0
|
||||
#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1
|
||||
#Oct 18 06:11:11 foohost login: login on ttyv0 as root
|
||||
#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0
|
||||
#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3
|
||||
#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0
|
||||
#
|
||||
|
||||
#
|
||||
# sshd Problems
|
||||
# --------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*)
|
||||
desc=$0
|
||||
action=write - USERACT: $1 sshd $2 problem, text: $3 at %t
|
||||
|
||||
#
|
||||
# sshd Accepted
|
||||
# --------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*)
|
||||
desc=$0
|
||||
action=write - USERACT: $1 sshd accepted login, text: $2 at %t
|
||||
|
||||
#
|
||||
# login FAILURES
|
||||
# ---------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*)
|
||||
desc=$0
|
||||
action=write - USERACT: $1 login $2 on $4 at %t
|
||||
|
||||
#
|
||||
# su bad
|
||||
# -----------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+)
|
||||
desc=$0
|
||||
action=write - USERACT: $1 su: $2 $3 to $4 on $5 at %t
|
||||
|
||||
#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0
|
||||
#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3
|
||||
#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0
|
||||
#
|
||||
#
|
||||
# su good to root
|
||||
# -----------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+)
|
||||
desc=$0
|
||||
action=write - USERACT: $1 su: $2 to ROOT on $4 at %t
|
||||
|
||||
|
||||
307
bsd-general.sec
Normal file
307
bsd-general.sec
Normal file
|
|
@ -0,0 +1,307 @@
|
|||
# General log events, unix systems. From various sources
|
||||
#
|
||||
# Copyright (C) 2003-2009 Jim Brown
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#
|
||||
# Bad su
|
||||
# -----------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
desc=$0
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+)
|
||||
action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
desc=$0
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: BAD SU (\S+) to (\S+) on (\S+)
|
||||
action=pipe '$2 failed SU to $3 on $1 at %t' /usr/bin/mail -s "USER: $2 Failed SU on $1" alerts@example.com
|
||||
|
||||
|
||||
# MONITOR.conf - SEC rules to pick up disruptive monitoring
|
||||
# events.
|
||||
#
|
||||
#Logs involving syslogd disabled or unusual promiscuous mode (MONITOR)
|
||||
#----------------------------------------------------------------------
|
||||
#Nov 15 20:02:48 foohost syslogd: exiting on signal 15
|
||||
#Nov 22 02:00:02 foohost syslogd: restart
|
||||
#Nov 11 15:58:55 foohost /kernel: de0: promiscuous mode enabled
|
||||
#Nov 11 15:58:57 foohost /kernel: de0: promiscuous mode disabled
|
||||
#
|
||||
|
||||
#
|
||||
# Syslog Exit
|
||||
# -----------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: exiting on signal (\d+)
|
||||
desc=$0
|
||||
action=write - MONITOR: $1 syslog exit on signal $2 at %t
|
||||
|
||||
#
|
||||
# Syslog Restart
|
||||
# ---------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+syslogd: restart
|
||||
desc=$0
|
||||
action=write - MONITOR: $1 syslog restart at %t
|
||||
|
||||
#
|
||||
# Syslog Exit
|
||||
# -----------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+) promiscuous mode (\S+)
|
||||
desc=$0
|
||||
action=write - MONITOR: $1 $2 promiscuous mode $3 at %t
|
||||
|
||||
|
||||
#
|
||||
# sshd Problems
|
||||
# --------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*)
|
||||
desc=$0
|
||||
action=write - USERACT: $1 sshd $2 problem, text: $3 at %t
|
||||
|
||||
#
|
||||
# sshd Accepted
|
||||
# --------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: Accepted (.*)
|
||||
desc=$0
|
||||
action=write - USERACT: $1 sshd accepted login, text: $2 at %t
|
||||
|
||||
#
|
||||
# login FAILURES
|
||||
# ---------------
|
||||
#
|
||||
#type=Single
|
||||
#ptype=RegExp
|
||||
#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+login: (.*?FAILURE.)(.*?ON) (.*)
|
||||
#desc=$0
|
||||
#action=write - USERACT: $1 login $2 on $4 at %t
|
||||
|
||||
|
||||
#SSH Auth failure on bsd 5
|
||||
#type=Single
|
||||
#ptype=RegExp
|
||||
#pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: error: PAM: authentication error for (/S+) from (/S+)
|
||||
#desc=$0
|
||||
#action=pipe 'SSHD: 1 $1 2 $2 3 $3 to 4 $4 on 5 $5 at %t' /usr/bin/mail -s "SSHD: $1 $2 $3 to $4 on $5 at %t' alerts@example.com
|
||||
|
||||
#
|
||||
# su bad
|
||||
# -----------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (BAD SU) (\S+) to (\S+) on (\S+)
|
||||
desc=$0
|
||||
action=pipe 'USER: $1 SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com
|
||||
|
||||
#Nov 10 19:40:03 foohost su: jpb to root on /dev/ttyp0
|
||||
#Nov 18 09:37:38 foohost su: BAD SU jpb to root on /dev/ttyp3
|
||||
#Nov 22 12:26:44 foohost su: BAD SU badboy to root on /dev/ttyp0
|
||||
#
|
||||
#
|
||||
# su good to root
|
||||
# -----------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+su: (\S+) to root on (\S+)
|
||||
desc=$0
|
||||
action=pipe 'USER: $1 GOOD SU: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com
|
||||
#action=write - USERACT: $1 su: $2 to ROOT on $4 at %t
|
||||
|
||||
#
|
||||
# Cabling Problem
|
||||
# ----------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: (\S+)\s+(.*?:) cable problem
|
||||
desc=$0
|
||||
action=event 0 $1 PHYSMOD:ORANGE cable problem on $2, text: $3 at %t
|
||||
|
||||
|
||||
|
||||
# USERACT - Events concerning user activities.
|
||||
#
|
||||
# Sample BSD logs involving logins, change of UID and privilege escalations.
|
||||
#---------------------------------------------------------------------------
|
||||
#Nov 14 12:14:58 foohost sshd[3388]: fatal: Timeout before authentication for 192.168.1.1
|
||||
#Nov 14 19:58:34 foohost sshd[6597]: Bad protocol version identification '^B^S^D^Q^L' from 192.168.1.100
|
||||
#Oct 18 06:16:53 foohost sshd[131]: Accepted keyboard-interactive/pam for foouser from 192.168.1.1 port 1077 ssh2
|
||||
#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2
|
||||
#Nov 15 04:02:24 foohost login: 1 LOGIN FAILURE ON ttyp2, mysql
|
||||
#Oct 18 03:20:46 foohost login: 2 LOGIN FAILURES ON ttyv0
|
||||
#Oct 18 02:52:04 foohost login: ROOT LOGIN (root) ON ttyv1
|
||||
#Oct 18 06:11:11 foohost login: login on ttyv0 as root
|
||||
#Nov 10 19:40:03 foohost su: foouser to root on /dev/ttyp0
|
||||
#Nov 18 09:37:38 foohost su: BAD SU foouser to root on /dev/ttyp3
|
||||
#Nov 22 12:26:44 foohost su: BAD SU goodboy to root on /dev/ttyp0
|
||||
#
|
||||
|
||||
#
|
||||
# sshd Problems
|
||||
# --------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+sshd\[\d+\]: (fatal|Bad)(.*)
|
||||
desc=$0
|
||||
action=pipe 'USER: $1 su: $2 $3 to $4 on $5 at %t' /usr/bin/mail -s "USERACT: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com
|
||||
#action=event 0 $1 USERACT:YELLOW sshd $2 problem, text: $3 at %t
|
||||
|
||||
#
|
||||
# login FAILURES
|
||||
# ---------------
|
||||
# ORANGE
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(sshd|login): (.*?FAILURE.)(.*?ON) (.*)
|
||||
desc=$0
|
||||
action=pipe 'USER: $1: Login Failure $2 on $4 at %t' /usr/bin/mail -s "USER: $1 su: $2 $3 to $4 on $5 at %t' alerts@example.com
|
||||
#action=event 0 $1 USERACT:YELLOW login $2 on $4 at %t
|
||||
|
||||
|
||||
# NETWACT - SEC rules to pick up suspicious network events.
|
||||
#
|
||||
# Sample BSD logs involving odd or suspicious network activity.
|
||||
#--------------------------------------------------------------
|
||||
#Jun 3 17:46:24 foohost named[38298]: client 10.12.127.176#3714: request has invalid signature: tsig verify failure
|
||||
#Apr 14 16:23:08 foohost /kernel: arp: 10.10.152.12 moved from 00:90:27:37:35:cf to 00:d0:59:aa:61:11 on de0
|
||||
#Apr 1 11:23:39 sixshooter /kernel: Limiting closed port RST response from 368 to 200 packets per second
|
||||
|
||||
|
||||
#
|
||||
# named Dynamic DNS Update rejection
|
||||
# ----------------------------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+named\[\d+\]: client (\S+): request has invalid signature:(.*)
|
||||
desc=$0
|
||||
action=pipe 'NET: $1 dyndns attempt from $2' /usr/bin/mail -s "NET: $1 dyndns attempt from $2, text: $3 at %t" alerts@example.com
|
||||
|
||||
#
|
||||
# MAC address moved
|
||||
# -----------------
|
||||
# ORANGE
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: arp: (\S+) moved from (\S+) to (\S+) on (\S+)
|
||||
desc=$0
|
||||
action=pipe 'NET: $1 arp moved on $2' /usr/bin/mail -s "NET: $1 arp moved on $2 from: $3 to $4 on $5 at %t" alerts@example.com
|
||||
|
||||
#
|
||||
# DoS RST rate limit
|
||||
# ------------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Limiting closed port RST response from (\d+) to (\d+)
|
||||
desc=$0
|
||||
action=pipe 'NET: $1 RST limit enforced: $2 to $3 at %t' /usr/bin/mail =s "NET: $1 RST limit enforced: $2 to $3" alerts@example.com
|
||||
|
||||
|
||||
|
||||
# COMPROM - SEC rules to pick up potential system compromise events.
|
||||
#
|
||||
# Sample BSD logs involving potential system compromise.
|
||||
#-------------------------------------------------------
|
||||
#May 25 18:09:55 foohost ntpd[1325]: ntpd exiting on signal 11
|
||||
#Jul 21 18:33:16 foohost /kernel: pid 55454 (ftpd), uid 1001: exited on signal 8
|
||||
#Apr 9 12:57:06 foohost /kernel: pid 28039 (telnet), uid 0: exited on signal 3 (core dumped)
|
||||
|
||||
#
|
||||
# ntpd crash
|
||||
# ------------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+ntpd\[\d+\]: ntpd exiting on signal (\d+)
|
||||
desc=$0
|
||||
action=pipe 'CRASH: $1 ntpd crashed on signal $2 at %t' /usr/bin/mail -s "CRASH: $1 ntpd crashed" alerts@example.com
|
||||
|
||||
#
|
||||
# Process crash
|
||||
# ------------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: pid \d+ \(\S+\), uid (\d+): exited on signal (\d+)
|
||||
desc=$0
|
||||
action=pipe 'CRASH: $1 $2 crashed on signal $4, uid $3 at %t' /usr/bin/mail -s "CRASH: $1 $2 crashed" alerts@example.com
|
||||
|
||||
|
||||
|
||||
# PROCESS - SEC rules to pick up suspicious process events.
|
||||
#
|
||||
# Sample BSD logs involving unusual processes.
|
||||
#---------------------------------------------
|
||||
#Mar 23 08:05:52 foohost thttpd[126]: thttpd/2.25b 29dec2003 starting on port 8090
|
||||
|
||||
#
|
||||
# Suspicious processes
|
||||
# --------------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+(thttpd)\[(\d+)\]:(.*)
|
||||
desc=$0
|
||||
action=pipe 'SUSPROC: $1 suspicious process $2 pid $3, text: $4 at %t' /usr/bin/mail -s "SUSPROC: $1 suspicious process $2" alerts@example.com
|
||||
|
||||
|
||||
|
||||
# SHUTRST - SEC rules to pick up system shutdown, restart events.
|
||||
#
|
||||
# Sample BSD logs involving system shutdown and reset.
|
||||
#-----------------------------------------------------
|
||||
#Mar 6 16:28:13 foohost reboot: rebooted by foouser
|
||||
#Jul 15 17:35:49 foohost halt: halted by root
|
||||
#Mar 6 16:29:17 foohost /kernel: Copyright (c) 1992-2003 The FreeBSD Project.
|
||||
|
||||
#
|
||||
# Reboot message
|
||||
# --------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+reboot: rebooted by (\S+)
|
||||
desc=$0
|
||||
action=pipe 'REBOOT: $1 rebooted by $2' /usr/bin/mail -s "REBOOT: $1 rebooted by $2" alerts@example.com
|
||||
|
||||
#
|
||||
# Halt message
|
||||
# --------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+halt: halted by (\S+)
|
||||
desc=$0
|
||||
action=pipe 'HALT: $1 halted by $2' /usr/bin/mail -s "HALT: $1 halted by $2" alerts@example.com
|
||||
|
||||
#
|
||||
# Restart message
|
||||
# --------------
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+/kernel: Copyright \(c\) (\S+) The FreeBSD Project
|
||||
desc=$0
|
||||
action=pipe 'RESTART: $1 restart message at %t' /usr/bin/mail -s "RESTART: $1 restart message" alerts@example.com
|
||||
|
||||
26
bsd-mpd.sec
Normal file
26
bsd-mpd.sec
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
#############################################################################
|
||||
# BSD mpd events
|
||||
#
|
||||
# Copyright (C) 2003-2009 Matt Jonkman
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#############################################################################
|
||||
|
||||
type=single
|
||||
desc = mpd connection start
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) mpd: PPTP connection from (\d+\.\d+\.\d+\.\d+):\d+
|
||||
action=add GENERAL_REPORT MPD Start from $2 on $1
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) mpd: Name: (.*)
|
||||
desc = mpd user auth
|
||||
action=add GENERAL_REPORT MPD User $2 Auth on $1
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=([A-z._0-9-]*) mpd: pptp\d: killing connection with (\d+\.\d+\.\d+\.\d+):\d+
|
||||
desc=mpd connection end
|
||||
action=add GENERAL_REPORT MPD Connection end from $2 on $1
|
||||
477
cisco-syslog.sec
Normal file
477
cisco-syslog.sec
Normal file
|
|
@ -0,0 +1,477 @@
|
|||
#############################################################################
|
||||
# SEC rules for processing Cisco syslog messages
|
||||
#
|
||||
# Copyright (C) 2008-2009 Omer Ben-Shalom, Risto Vaarandi
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#############################################################################
|
||||
|
||||
# ----- Process system configuration events -----
|
||||
|
||||
# System configuration events
|
||||
# suppressed because we don't care about it
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%SYS-5-CONFIG_I:
|
||||
desc=device configuration
|
||||
|
||||
# System configuration sync to standby router
|
||||
# suppressed because we don't care about it
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%PFINIT-SP-5-CONFIG_SYNC:
|
||||
desc=config sync
|
||||
|
||||
# ----- Process reload and restart events -----
|
||||
|
||||
# Looks for a reload
|
||||
#
|
||||
type=single
|
||||
continue=takeNext
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD: (.*)
|
||||
desc=(WARNING) reload requested for $1
|
||||
action=pipe '%s details:$2' mail -s 'cisco event' root@example.com
|
||||
|
||||
# Looks for a reload followed by a restart event
|
||||
#
|
||||
type=pairWithWindow
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SYS-5-RELOAD:
|
||||
desc=(CRITICAL) $1 RELOAD_PROBLEM
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
ptype2=regexp
|
||||
pattern2=($1).*?%SYS-5-RESTART:
|
||||
desc2=(NOTICE) $1 RELOAD_OK
|
||||
action2=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=300
|
||||
|
||||
# Looks for a restart without reload command
|
||||
#
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=(\S+) \d+:.*?%SYS-5-RESTART:
|
||||
desc=(CRITICAL) $1 restart without reload command
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
|
||||
# ----- process SNMP authentication failure events -----
|
||||
|
||||
# this rule handles the SNMP authentication failures
|
||||
# only one notification is sent for each source that is doing this per day
|
||||
#
|
||||
type=singleWithSuppress
|
||||
ptype=regexp
|
||||
pattern=(\S+) \d+:.*?%SNMP-3-AUTHFAIL: Authentication failure for SNMP req from host (\S+)
|
||||
desc=(WARNING) Auth fail coming from $2
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=86400
|
||||
|
||||
# ----- process OSPF neighbor change events -----
|
||||
|
||||
# This rule handles OSPF neighbor changes
|
||||
#
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OSPF-5-ADJCHG:.*?Nbr (\S+) on (\S+) from (\S+) to (\S+), (.*)
|
||||
desc=(MINOR) OSPF adjacency change: Router $1 reports that the neighbor on $3 ($2) changed from state $4 to state $5 detail:$6
|
||||
action=event %s; pipe '%s' mail -s 'cisco event' root@example.com
|
||||
|
||||
# This rule escalates to CRITICAL if there are more than 5 neighbor changes
|
||||
# in 5 seconds
|
||||
#
|
||||
type=SingleWithThreshold
|
||||
ptype=substr
|
||||
pattern=(MINOR) OSPF adjacency change
|
||||
desc=(CRITICAL) More than 5 OSPF neighbor changes in 5 seconds
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
thresh=5
|
||||
window=5
|
||||
|
||||
# ----- process HSRP events -----
|
||||
|
||||
# This rule assembles together all HSRP events
|
||||
#
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%STANDBY-6-STATECHANGE: (\S+).*?state (\S+) -> (\S+)
|
||||
desc=HSRP change for $1 interface $2 - changed from $3 to $4
|
||||
action=add HSRP_$1 %t: %s; set HSRP_$1 5 (report HSRP_$1 mail -s 'cisco events' root@example.com)
|
||||
|
||||
# ----- process duplex mismatch events -----
|
||||
|
||||
# this rule handles the duplex mismatch event
|
||||
# only one notification is sent for each port that has duplex mismatch
|
||||
# reported per day
|
||||
#
|
||||
type=singleWithSuppress
|
||||
ptype=regexp
|
||||
pattern=(\S+) \d+:.*?%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on (not \S+) \((.*?)\), with (\S+) (\S+) \((.*?)\)
|
||||
desc=(WARNING) Duplex mismatch between $1 port $2 ($3), other side is $4 port $5 ($6)
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=86400
|
||||
|
||||
# ----- process link down and link up events -----
|
||||
|
||||
# This rule deals with link down events
|
||||
#
|
||||
type=PairWithWindow
|
||||
ptype=RegExp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINK-3-UPDOWN: Interface (\S+), changed state to down
|
||||
desc=(MINOR) $1 INTERFACE $2 DOWN and not up in one minute
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
ptype2=RegExp
|
||||
pattern2=($1)\s+\d+:.*?%LINK-3-UPDOWN: Interface ($2), changed state to up
|
||||
desc2=(WARNING) %1 INTERFACE %2 BOUNCE
|
||||
action2=event %s
|
||||
window=60
|
||||
|
||||
# when the first bounce event is seen, create a reporting trigger
|
||||
#
|
||||
type=Single
|
||||
continue=TakeNext
|
||||
ptype=regexp
|
||||
pattern=(\S+) INTERFACE \S+ BOUNCE
|
||||
context=!INTERFACE_BOUNCE_WAIT_$1
|
||||
desc=interface bounce summary event for router $1
|
||||
action=create INTERFACE_BOUNCE_WAIT_$1 10 (report INTERFACE_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete INTERFACE_BOUNCE_$1)
|
||||
|
||||
# accumulate all interface bounce events into a context
|
||||
#
|
||||
type=Single
|
||||
ptype=regexp
|
||||
pattern=(\S+) INTERFACE (\S+) BOUNCE
|
||||
desc=interface bounce for router $1 interface $2 detected
|
||||
action=add INTERFACE_BOUNCE_$1 %t: %s
|
||||
|
||||
# ----- process line protocol down and line protocol up events -----
|
||||
|
||||
# This rule deals with protocol up/down events
|
||||
#
|
||||
type=PairWithWindow
|
||||
ptype=RegExp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface (\S+), changed state to down
|
||||
desc=(MINOR) $1 INTERFACE $2 line protocol DOWN and not up in one minute
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
ptype2=RegExp
|
||||
pattern2=($1)\s+\d+:.*?%LINEPROTO-5-UPDOWN: Line protocol on Interface ($2), changed state to up
|
||||
desc2=(WARNING) %1 INTERFACE %2 line protocol BOUNCE
|
||||
action2=event %s
|
||||
window=60
|
||||
|
||||
# when the first bounce event is seen, create a reporting trigger
|
||||
#
|
||||
type=Single
|
||||
continue=TakeNext
|
||||
ptype=regexp
|
||||
pattern=(\S+) INTERFACE \S+ line protocol BOUNCE
|
||||
context=!LINE_PROTOCOL_BOUNCE_WAIT_$1
|
||||
desc=line protocol bounce for router $1
|
||||
action=create LINE_PROTOCOL_BOUNCE_WAIT_$1 10 (report LINE_PROTOCOL_BOUNCE_$1 mail -s 'cisco events' root@example.com; delete LINE_PROTOCOL_BOUNCE_$1)
|
||||
|
||||
# accumulate all line protocol bounce events into a context
|
||||
#
|
||||
type=Single
|
||||
ptype=regexp
|
||||
pattern=(\S+) INTERFACE (\S+) line protocol BOUNCE
|
||||
desc=line protocol bounce for router $1 interface $2 detected
|
||||
action=add LINE_PROTOCOL_BOUNCE_$1 %t: %s
|
||||
|
||||
# ----- process late collision events -----
|
||||
|
||||
# Late collision alerts
|
||||
#
|
||||
type=SingleWithThreshold
|
||||
ptype=RegExp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%PM_SCP-SP-4-LCP_FW_ABLC: Late collision message from module (\d+), port:(\d+)
|
||||
desc=(MINOR) Multiple late collision events on $1 module $2 port $3
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=3600
|
||||
thresh=5
|
||||
|
||||
# ----- process host flap events -----
|
||||
|
||||
# host flapping on single vlan
|
||||
#
|
||||
type=SingleWithThreshold
|
||||
continue=TakeNext
|
||||
ptype=RegExp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+)
|
||||
desc=(MINOR) multiple hosts flapping between ports $4 and $5 in $1 vlan $3
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=300
|
||||
thresh=5
|
||||
|
||||
# host flapping on multiple vlans
|
||||
#
|
||||
type=SingleWithThreshold
|
||||
continue=TakeNext
|
||||
ptype=RegExp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_EBM-4-HOSTFLAPPING: Host (\S+) in vlan (\S+) is flapping between port (\S+) and port (\S+)
|
||||
desc=(MINOR) multiple hosts are flapping between ports $4 and $5 in $1 (potentially on multiple VLANs)
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=300
|
||||
thresh=20
|
||||
|
||||
# ----- process misc hw events -----
|
||||
|
||||
# %FILESYS-SP-STDBY-5-DEV:# flash disk removal
|
||||
#
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%FILESYS-SP-STDBY-5-DEV:.*?PCMCIA flash card removed from (\S+)
|
||||
desc=(WARNING) Flash card removed from $1 $2
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
|
||||
# %OIR-SP-STDBY-6-CONSOLE
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%OIR-SP-STDBY-6-CONSOLE
|
||||
desc=console access to route processor changed
|
||||
|
||||
# %OIR-SP-6-INSCARD: - card inserted
|
||||
#
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%OIR-SP-6-INSCARD: Card inserted in slot (\d+), (.*)
|
||||
desc=(HARMLESS) card inserted in $1 slot $2 status:$3
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
|
||||
# ----- process module events -----
|
||||
|
||||
# %DIAG-SP-3-TEST_FAIL - diagnostics failed on a module
|
||||
#
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DIAG-SP-3-TEST_FAIL: Module (\d+): (.*)
|
||||
desc=(WARNING) diagnostics failed for $1 module $2 detail:$3
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
|
||||
# %SNMP-5-MODULETRAP
|
||||
# Looks for a module down followed by module up event
|
||||
#
|
||||
type=pairWithWindow
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-MODULETRAP: Module (\d+) [Down] Trap
|
||||
desc=(MINOR) $1 Module DOWN (not back up in a minute)
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
ptype2=regexp
|
||||
pattern2=($1) .*? %SNMP-5-MODULETRAP: Module ($2) [Up] Trap
|
||||
desc2=(WARNING) $1 Module $2 BOUNCE (down and back up within a minute)
|
||||
action2=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=60
|
||||
|
||||
# ----- process irrelevant events (by suppressing) -----
|
||||
|
||||
# %SYS-SP-STDBY-5-RESTART - system restarted part of the boot - interesting?
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=SYS-SP-STDBY-5-RESTART
|
||||
desc=system restarted
|
||||
|
||||
# %DIAG-SP-6-TEST_RUNNING - Running system test
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%DIAG-SP-6-TEST_RUNNING
|
||||
desc=running diagnostics on a module
|
||||
|
||||
# %FABRIC-SP-5-FABRIC_MODULE_BACKUP - module changed to backup state
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP
|
||||
desc=module became backup
|
||||
|
||||
# %DIAG-SP-6-RUN_MINIMUM - diagnostics are run
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%DIAG-SP-6-RUN_MINIMUM
|
||||
desc=diagnostics running on switch
|
||||
|
||||
# %DIAG-SP-6-DIAG_OK - diagnostics results are OK
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%DIAG-SP-6-DIAG_OK
|
||||
desc=diagnostics results are OK
|
||||
|
||||
# %PFREDUN-SP-STDBY-6-STANDBY - SSO events
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%PFREDUN-SP-STDBY-6-STANDBY
|
||||
desc=SSO event (startup)
|
||||
|
||||
# %PFREDUN-SP-STDBY-6-STANDBY - SSO events
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%PFREDUN-SP-6-ACTIVE
|
||||
desc=SSO event (startup)
|
||||
|
||||
# %FABRIC-SP-5-FABRIC_MODULE_BACKUP: - secondary sup is up and is secondary
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%FABRIC-SP-5-FABRIC_MODULE_BACKUP:
|
||||
desc=secondary sup is up and is secondary
|
||||
|
||||
# %PFINIT-SP-5-CONFIG_SYNC - startup config on standby router sync
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%PFINIT-SP-5-CONFIG_SYNC
|
||||
desc=startup config on standby router sync
|
||||
|
||||
# %C4K_REDUNDANCY - Cayt 4K configuration/vlan database succesful sync
|
||||
# the success match is to allow fails in sync to not be suppress
|
||||
#
|
||||
type=suppress
|
||||
ptype=regexp
|
||||
pattern=%C4K_REDUNDANCY.*?success
|
||||
desc=config sync with standby supervisor
|
||||
|
||||
# %SCP-SP-5-ASYNC_WATERMARK: SCP long queue wait
|
||||
# the success match is to allow fails in sync to not be suppress
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%SCP-SP-5-ASYNC_WATERMARK:
|
||||
desc=SCP control protocol pending queue is longer than notification threshold
|
||||
|
||||
# %MLS_RATE-4-DISABLING: - Layer2 Rate Limiters have been disabled. Is this interesting?
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%MLS_RATE-4-DISABLING:
|
||||
desc=Layer2 Rate Limiters have been disabled
|
||||
|
||||
# ----- process native VLAN mismatch events -----
|
||||
|
||||
# %CDP-4-NATIVE_VLAN_MISMATCH: - native VLAN mismatch between switches, will repeat every minute until fixed
|
||||
#
|
||||
type=singleWithSuppress
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on (\S+) \((\d+)\), with (\S+) (\S+) \((\d+)\)
|
||||
desc=(MINOR) A native VLAN mistmatch reported between $1 interface $2 (native VLAN $3) and host $4 interface $5 (native VLAN $6)
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=60
|
||||
|
||||
# ----- process snmp trapblock messages -----
|
||||
|
||||
# %SNMP-3-TRAPBLOCK - A process tried to create a trap it is not entitled to create
|
||||
# See Cisco http://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi?action=search&counter=0&paging=5&query=SNMP-3-TRAPBLOCK
|
||||
#
|
||||
type=suppress
|
||||
ptype=substr
|
||||
pattern=%SNMP-3-TRAPBLOCK
|
||||
desc=a process tried to create a trap it is not entitled to create
|
||||
|
||||
# ----- process chassis alarm events -----
|
||||
|
||||
# %SNMP-5-CHASSISALARM - this rule handles the tmpAlarm
|
||||
#
|
||||
type=pairWithWindow
|
||||
continue=takeNext
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(ON\)
|
||||
desc=(MINOR) $1 temprature alarm signaled and not cleared in five minutes
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
continue2=takeNext
|
||||
ptype2=regexp
|
||||
pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*%SNMP-5-CHASSISALARM: Chassis Alarm Trap: tmpAlarm\(OFF\)
|
||||
desc2=(WARNING) $1 temprature alarm went on and was cleared in under five minutes
|
||||
action2=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=300
|
||||
|
||||
# %SNMP-5-CHASSISALARM - this rule handles the minorAlarm
|
||||
#
|
||||
type=pairWithWindow
|
||||
continue=takeNext
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(ON\)
|
||||
desc=(MINOR) $1 minor alarm reported and not cleared in three minutes
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
continue2=takeNext
|
||||
desc2=(WARNING) $1 minor alarm went on and was cleared in under three minutes
|
||||
ptype2=regexp
|
||||
pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? minorAlarm\(OFF\)
|
||||
action2=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=180
|
||||
|
||||
# %SNMP-5-CHASSISALARM - this rule handles the majorAlarm
|
||||
#
|
||||
type=pairWithWindow
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(ON\)
|
||||
desc=(MINOR) $1 major alarm signaled and not cleared in two minutes
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
ptype2=regexp
|
||||
pattern2=\d+:\d+:\d+.*?($1)\s+\d+:.*?%SNMP-5-CHASSISALARM: Chassis Alarm Trap: .*? majorAlarm\(OFF\)
|
||||
desc2=(WARNING) $1 major alarm went on and was cleared in under two minutes
|
||||
action2=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=120
|
||||
|
||||
# ----- process power supply related events -----
|
||||
|
||||
# %C4K_IOSMODPORTMAN events - this one is about power supplies only
|
||||
#
|
||||
type=pairWithWindow
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD: Power Supply (\d+) has failed or been turned off
|
||||
desc=(MINOR) $1 power supply $2 reported bad and event not cleared in two minutes
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
ptype2=regexp
|
||||
pattern2=($1) .*? %C4K_IOSMODPORTMAN-6-POWERSUPPLYGOOD: Power Supply ($2) is Okay
|
||||
desc2=(WARNING) $1 power supply $2 alarm went on and was cleared in under two minutes
|
||||
action2=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=120
|
||||
|
||||
# ----- process neighbor down and neighbor up events -----
|
||||
|
||||
# %DVMRP-5-NBRDOWN
|
||||
#
|
||||
type=pairWithWindow
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%DVMRP-5-NBRDOWN: Neighbor (\S+) went down on (\S+)
|
||||
desc=(MINOR) $1 lost DVMRP neighbor $2 on interface $3 and it did not come up in two minutes
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
ptype2=regexp
|
||||
pattern2=($1) .*? %DVMRP-5-NBRUP: Neighbor ($2) is up on ($3)
|
||||
desc2=(WARNING) $1 lost DVMRP neighbor $2 on interface $3 but id come up within two minutes
|
||||
action2=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=120
|
||||
|
||||
# ----- process fan power supply failure/ok events -----
|
||||
|
||||
# %C6KENV-SP-4-PSFANF events - this one is about fan failures
|
||||
#
|
||||
type=pairWithWindow
|
||||
ptype=regexp
|
||||
pattern=\d+:\d+:\d+.*?(\S+)\s+\d+:.*?%C6KENV-SP-4-PSFANFAILED: the fan in power supply (\d+) has failed
|
||||
desc=(MINOR) $1 fan in power supply $2 was reported bad and event not cleared in two minutes
|
||||
action=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
ptype2=regexp
|
||||
pattern2=($1) .*? %C6KENV-SP-4-PSFANOK: the fan in power supply (\d+) is OK
|
||||
desc2=(WARNING) $1 fan in power supply $2 alarm went on and was cleared in under two minutes
|
||||
action2=pipe '%s' mail -s 'cisco event' root@example.com
|
||||
window=120
|
||||
|
||||
# ----- process events that have not been matched by any of above rules -----
|
||||
|
||||
# Default match
|
||||
# this rule will match anything not previously matched but allows only
|
||||
# one notification per day for each new event class seen
|
||||
#
|
||||
type=singleWithSuppress
|
||||
ptype=regexp
|
||||
pattern=(%.*?:)
|
||||
desc=$1
|
||||
action=pipe '$0' mail -s 'cisco event' root@example.com
|
||||
window=86400
|
||||
14
conf.README
14
conf.README
|
|
@ -2,11 +2,9 @@ This is the SEC configuration directory. Because SEC usage varies so widely
|
|||
from user to user, this package is configured by default to not run.
|
||||
|
||||
The commented-out default settings in /etc/sysconfig/sec will load any file in
|
||||
this directory with a .sec suffix. You can find several example rules at
|
||||
|
||||
https://github.com/simple-evcorr/rulesets
|
||||
|
||||
and install the ones you want here (taking into account that the examples are
|
||||
generic and some of them may need to be tweaked to work with your setup). You
|
||||
should also read the SEC man page so you have at least a basic understanding of
|
||||
the SEC configuration commands.
|
||||
this directory with a .sec suffix. Please look through the example files
|
||||
included in /usr/share/doc/sec-<version>/examples/ and install the ones you
|
||||
want here (taking into account that the examples are generic and some of them
|
||||
may need to be tweaked to work with your setup). You should also read the SEC
|
||||
man page so you have at least a basic understanding of the SEC configuration
|
||||
commands.
|
||||
|
|
|
|||
44
cvs.sec
Normal file
44
cvs.sec
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
#############################################################################
|
||||
# CVS events
|
||||
#
|
||||
# Copyright (C) 2003-2009 Matt Jonkman
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#############################################################################
|
||||
|
||||
#Jul 31 19:54:21 xxxx xinetd[2088]: START: cvspserver pid=16385 from=xx.xx.xx.xx
|
||||
|
||||
type=single
|
||||
desc = cvsp server connection start
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) xinetd\[\d+\]: START: cvspserver pid=\d+ from=(\d+\.\d+\.\d+\.\d+)
|
||||
action=add GENERAL_REPORT CVS Connection from $2 on $1
|
||||
|
||||
|
||||
#Aug 5 10:38:29 xxxx cvs: password mismatch for username in /usr/local/cvsroot: PMOv/9hZsf6v. vs. PMMlzZLYrbthY
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) cvs: password mismatch for (.*) in (.*)
|
||||
desc = cvs login failure
|
||||
action=pipe '$1 $2 CVS Login Failure: User $2 from $3' /usr/bin/mail -s '$1 $2 CVS Login Failure: $2 from $3' alerts@example.com
|
||||
|
||||
|
||||
#Aug 5 10:38:49 xxxx cvs: attempt to root from account: username
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) cvs: attempt to root from account: (.*)
|
||||
desc = cvs login to root attempt
|
||||
action=pipe ' $1 $2 CVS Login to Root Attempt: User $2 ' /usr/bin/mail -s '$1 CVS Login to Root Failure: $2' alerts@example.com
|
||||
|
||||
|
||||
#Aug 5 10:42:37 xxxx cvs: login failure (for /usr/local/cvsroot)
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) cvs: login failure \(for /usr/local/cvsroot\)
|
||||
desc = cvs login failure
|
||||
action=pipe '$1 $2 CVS Login Failure ' /usr/bin/mail -s '$1 CVS Login Failure' alerts@example.com
|
||||
|
||||
24
dameware.sec
Normal file
24
dameware.sec
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
#############################################################################
|
||||
# Dameware events
|
||||
#
|
||||
# Copyright (C) 2003-2009 Matt Jonkman
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#############################################################################
|
||||
|
||||
#Dameware Connect
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) DMWRCS: (.*) Connect: (.*)
|
||||
desc = Dameware Connect
|
||||
action=add WINDOWS_REPORT DAMEWARE CONNECT: %s; \
|
||||
pipe 'DAMEWARE Connect -- : %s' /usr/bin/mail -s 'DAMEWARE CONNECT' alerts@example.com
|
||||
|
||||
|
||||
#Dameware Disconnect
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) DMWRCS: (.*) Disconnect: (.*)
|
||||
desc = Dameware Disconnect
|
||||
action=add WINDOWS_REPORT DAMEWARE DISCONNECT: %s
|
||||
114
hp-openview.sec
Normal file
114
hp-openview.sec
Normal file
|
|
@ -0,0 +1,114 @@
|
|||
################################################################
|
||||
# Sample SEC ruleset for HP OpenView ITO
|
||||
#
|
||||
# Copyright (C) 2003-2010 Risto Vaarandi
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
################################################################
|
||||
|
||||
# process Cisco linkDown/linkUp trap events received from
|
||||
# HP OpenView ITO trap template through itostream plugin
|
||||
|
||||
type=PairWithWindow
|
||||
ptype=RegExp
|
||||
pattern=node=([\w.-]+) .*msg_text=cisco linkdown trap on interface ([\w-]+)\b
|
||||
desc=CISCO $1 INTERFACE $2 DOWN
|
||||
action=event %s;
|
||||
continue2=TakeNext
|
||||
ptype2=RegExp
|
||||
pattern2=node=$1 .*msg_text=cisco linkup trap on interface $2\b
|
||||
desc2=CISCO %1 INTERFACE %2 BOUNCE
|
||||
action2=event %s;
|
||||
window=20
|
||||
|
||||
type=SingleWithSuppress
|
||||
continue=TakeNext
|
||||
ptype=RegExp
|
||||
pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) DOWN
|
||||
desc=cisco $1 interface $2 down
|
||||
action=reset +1 %s
|
||||
window=60
|
||||
|
||||
type=Pair
|
||||
ptype=RegExp
|
||||
pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) DOWN
|
||||
desc=cisco $1 interface $2 down
|
||||
action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major down
|
||||
ptype2=RegExp
|
||||
pattern2=node=$1 .*msg_text=cisco linkup trap on interface $2\b
|
||||
desc2=cisco %1 interface %2 up
|
||||
action2=shellcmd /home/opc_op/cisco_msg.sh %1 %2 normal up
|
||||
window=86400
|
||||
|
||||
type=SingleWith2Thresholds
|
||||
ptype=RegExp
|
||||
pattern=CISCO ([\w.-]+) INTERFACE ([\w-]+) BOUNCE
|
||||
desc=cisco $1 interface $2 is unstable
|
||||
action=shellcmd /home/opc_op/cisco_msg.sh $1 $2 major unstable
|
||||
window=3600
|
||||
thresh=10
|
||||
desc2=cisco $1 interface $2 is stable again
|
||||
action2=shellcmd /home/opc_op/cisco_msg.sh $1 $2 normal stable
|
||||
window2=10800
|
||||
thresh2=0
|
||||
|
||||
#
|
||||
# the cisco_msg.sh script:
|
||||
#
|
||||
##!/bin/sh
|
||||
#
|
||||
#NODE=$1
|
||||
#IF=$2
|
||||
#SEV=$3
|
||||
#TEXT=$4
|
||||
#
|
||||
## use snmpget utility from Net-SNMP package
|
||||
#IFNAME=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.2.1.2.2.1.2.$IF`
|
||||
#DESCR=`/usr/bin/snmpget -c public -OQv $NODE .1.3.6.1.4.1.9.2.2.1.1.28.$IF`
|
||||
#
|
||||
#MSG=`echo "Interface $IFNAME ($DESCR) $TEXT" | sed s/\"/\'/g`
|
||||
#
|
||||
#/opt/OV/bin/OpC/opcmsg node=$NODE app=cisco obj=if \
|
||||
# sev=$SEV msg_grp=Network msg_text="$MSG"
|
||||
#
|
||||
|
||||
|
||||
# process APC ups "not online" trap events received from
|
||||
# HP OpenView ITO trap template through itostream plugin
|
||||
|
||||
type=SingleWithScript
|
||||
ptype=RegExp
|
||||
pattern=node=([\w.-]+) .*msg_text=APC ups not online
|
||||
script=/home/opc_op/check_apc.sh $1
|
||||
desc=APC ups is not online!
|
||||
action=shellcmd /opt/OV/bin/OpC/opcmsg node=$1 app=APC obj=state \
|
||||
msg_grp=UPS sev=critical msg_text='%s'
|
||||
|
||||
#
|
||||
# the check_apc.sh script
|
||||
#
|
||||
##!/bin/sh
|
||||
#
|
||||
## sleep for a few seconds and check if the UPS error is still present;
|
||||
## if it is, exit with 0, otherwise exit with 1
|
||||
#
|
||||
#UPS=$1
|
||||
#sleep 5
|
||||
#
|
||||
## use snmpget utility from Net-SNMP package
|
||||
#STATUS=`/usr/bin/snmpget -c public -OQve $UPS .1.3.6.1.4.1.318.1.1.1.4.1.1.0`
|
||||
#
|
||||
## According to the APC Powernet MIB the variable .1.3.6.1.4.1.318.1.1.1.4.1.1
|
||||
## takes the the following values: unknown(1), onLine(2), onBattery(3),
|
||||
## onSmartBoost(4), timedSleeping(5), softwareBypass(6), off(7), rebooting(8),
|
||||
## switchedBypass(9), hardwareFailureBypass(10), sleepingUntilPowerReturn(11),
|
||||
## and onSmartTrim(12), where onLine(2) is the normal state for the UPS
|
||||
#
|
||||
#if [ $STATUS -eq 2 ]
|
||||
#then
|
||||
# exit 1
|
||||
#else
|
||||
# exit 0
|
||||
#fi
|
||||
#
|
||||
36
labrea.sec
Normal file
36
labrea.sec
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
#############################################################################
|
||||
# Labrea tarpit events
|
||||
#
|
||||
# Copyright (C) 2003-2009 Matt Jonkman
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#############################################################################
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Initial Connect \(tarpitting\): (\d+\.\d+\.\d+\.\d+\s\d+) \-> \d+\.\d+\.\d+\.\d+\s(.*)
|
||||
desc=$0
|
||||
action=add TARPIT_REPORT %t: $1 New Tarpitted Connect from $2 on port $3
|
||||
|
||||
#type=Single
|
||||
#ptype=RegExp
|
||||
#pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Additional Activity: (\d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+ (\d+)*
|
||||
#desc=$0
|
||||
#action=add TARPIT_REPORT %t: %s;
|
||||
#
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+LaBrea: Responded to a PING: (d+\.\d+\.\d+\.\d+) \d+ \-> \d+\.\d+\.\d+\.\d+
|
||||
desc=$0
|
||||
action=add TARPIT_REPORT %t: PING Sweep from $@ on $3
|
||||
|
||||
#Send hourly tarpit report
|
||||
|
||||
type=Calendar
|
||||
time=0 8,12,20 * * *
|
||||
desc=Sending tarpit report...
|
||||
action=report TARPIT_REPORT \
|
||||
/usr/bin/mail -s 'Tarpits: Tarpit Victim report' alerts@example.com; \
|
||||
delete TARPIT_REPORT
|
||||
1046
pix-general.sec
Normal file
1046
pix-general.sec
Normal file
File diff suppressed because it is too large
Load diff
246
pix-security.sec
Normal file
246
pix-security.sec
Normal file
|
|
@ -0,0 +1,246 @@
|
|||
####################################################################
|
||||
# SEC ruleset for Cisco PIX 6.x, 7.x
|
||||
#
|
||||
# Copyright (C) 2003-2009 Chris Sawall
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
####################################################################
|
||||
|
||||
# Process various events from PIX syslog output
|
||||
#
|
||||
# Submitted by Chris Sawall
|
||||
# email: sawall -[at]- gmail -[dot]- com
|
||||
# Last Updated: 5/20/05
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Watch for weird failures - possible trojan/worm
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# Watch for 10 denies within 10 seconds. Especially useful to monitor
|
||||
# for certain trojans and mass mailers
|
||||
#
|
||||
type=SingleWithThreshold
|
||||
ptype=RegExp
|
||||
pattern=\s*.*Deny\s+(\w+)\s+src.*:(.*)/.*:(.*)/(\b2\d\b).*$
|
||||
desc=Unusual Failures:$1 $4/$2 -> $3
|
||||
action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
|
||||
window=10
|
||||
thresh=10
|
||||
|
||||
# Monitor for occurrances of certain variant of PHEL trojan destined
|
||||
# for two different class C networks
|
||||
#
|
||||
type=Single
|
||||
continue=dontcont
|
||||
ptype=RegExp
|
||||
pattern=(212\.147\.14[12]\.)
|
||||
desc=Possible PHEL Trojan (1)
|
||||
action=create phel_$1; add phel_$1 Local Time = %t; add phel_$1 $0; report phel_$1 /bin/mail -s "%s" email01@example.com; delete phel_$1
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Watch for firewall failovers
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# Firewall failures/failovers
|
||||
# Works for PIX 7.x
|
||||
|
||||
# Failure of secondary (standby) firewall while primary is active
|
||||
# Works for PIX 7.x
|
||||
#
|
||||
# $1 is the IP address of the primary firewall
|
||||
#
|
||||
type=Single
|
||||
continue=takenext
|
||||
ptype=RegExp
|
||||
pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Primary\).*$
|
||||
desc=Secondary firewall for $1 - failure/reload
|
||||
action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
|
||||
|
||||
# Failure of secondary (standby) firewall while primary is active
|
||||
# Works for PIX 7.x
|
||||
#
|
||||
# $1 is the IP address of the primary firewall
|
||||
#
|
||||
type=Single
|
||||
continue=takenext
|
||||
ptype=RegExp
|
||||
pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX-1-102001.*\(Secondary\).*$
|
||||
desc=Primary firewall for $1 - failure/reload
|
||||
action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
|
||||
|
||||
# Failure of secondary (active), primary assumes active
|
||||
# Works for PIX 7.x
|
||||
#
|
||||
# The first "desc" and "action" don't really do anything here. But SEC requires them to be present.
|
||||
# $1 is the IP address of the primary firewall
|
||||
#
|
||||
type=Pair
|
||||
continue=dontcont
|
||||
ptype=RegExp
|
||||
pattern=PIX-1-102001:\s+\(Primary\).*$
|
||||
desc=$0
|
||||
action=logonly
|
||||
ptype2=RegExp
|
||||
pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Primary\).*Peer state Standby Ready
|
||||
desc2=Secondary (was active) firewall ($1) has failed. Primary is now active.
|
||||
action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
|
||||
window=5
|
||||
|
||||
# Failure of primary (active), secondary assumes active
|
||||
# Works for PIX 7.x
|
||||
#
|
||||
# The first "desc" and "action" don't really do anything here. But SEC requires them to be present.
|
||||
# $1 is the IP address of the primary firewall
|
||||
#
|
||||
type=Pair
|
||||
continue=dontcont
|
||||
ptype=RegExp
|
||||
pattern=PIX-1-102001:\s+\(Secondary\).*$
|
||||
desc=$0
|
||||
action=logonly
|
||||
ptype2=RegExp
|
||||
pattern2=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Secondary\).*Peer state Standby Ready
|
||||
desc2=Primary firewall ($1) has failed. Secondary is now active.
|
||||
action2=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
|
||||
window=5
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Watch for firewall reloads
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# Manual reload of PIX
|
||||
# Works for PIX 6.x
|
||||
#
|
||||
# $1 is the IP address of the primary firewall
|
||||
#
|
||||
type=Single
|
||||
continue=dontcont
|
||||
ptype=RegExp
|
||||
pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*PIX reload.*$
|
||||
desc=$1 has been manually rebooted
|
||||
action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com ; delete ffo_$1
|
||||
|
||||
# Manual reload of PIX
|
||||
# Works for PIX 7.x
|
||||
#
|
||||
# $1 is the IP address of the primary firewall
|
||||
#
|
||||
type=Single
|
||||
continue=dontcont
|
||||
ptype=RegExp
|
||||
pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*Orderly reload.*Reload reason:\s(\S+)
|
||||
desc=$1 has been manually rebooted, reason: $2
|
||||
action=create ffo_$1; add ffo_$1 %t; add ffo_$1 $0; report ffo_$1 /bin/mail -s "%s" email01@example.com; delete ffo_$1
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Watch for SSH logins/failures on firewalls
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# Suppress emails concerning pixbkup account
|
||||
# In this case, the pixbkup acct is used to backup the PIX firewalls
|
||||
# Keeping email alerts to a minimum, this skips past these alerts
|
||||
#
|
||||
type=Suppress
|
||||
continue=dontcont
|
||||
ptype=RegExp
|
||||
pattern=pixbkup
|
||||
|
||||
# Successful Admin SSH session
|
||||
# Works for PIX 6.x
|
||||
#
|
||||
# Monitor for successful SSH connections to the PIX firewall
|
||||
# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr
|
||||
#
|
||||
type=Single
|
||||
continue=dontcont
|
||||
ptype=RegExp
|
||||
pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'.*to\s(\d+\.\d+\.\d+\.\d+)\/0.*SSH
|
||||
desc=Admin Auth to $1.$2 -> $3 from $4
|
||||
action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
|
||||
|
||||
# Successful Admin SSH session
|
||||
# Works for PIX 7.x
|
||||
#
|
||||
# Monitor for successful SSH connections to the PIX firewall
|
||||
# $1 & $2 make up the IP of the firewall, $3 is the user account and $4 the source IP addr
|
||||
#
|
||||
type=Single
|
||||
continue=dontcont
|
||||
ptype=RegExp
|
||||
pattern=\s*.*(10|172|192)\.(\d+\.\d+\.\d+).*Authentication succeeded.*\'(\S+)\'\sfrom\s(\d+\.\d+\.\d+\.\d+)\/0.*/22.*$
|
||||
desc=Admin Auth to $1.$2 -> $3 from $4
|
||||
action=create ssh_$1; add ssh_$1 Local Time = %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
|
||||
|
||||
# Failed Admin SSH session
|
||||
# Works for PIX 6.x
|
||||
#
|
||||
# Monitor for failed SSH attempts to the PIX firewalls
|
||||
# $1 is the user acct
|
||||
#
|
||||
type=Single
|
||||
continue=takenext
|
||||
ptype=RegExp
|
||||
pattern=Authentication failed.*\'(\S+)\'.*SSH
|
||||
desc=Admin Auth FAILED -> $1
|
||||
action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
|
||||
|
||||
# Failed Admin SSH session
|
||||
# Works for PIX 7.x
|
||||
#
|
||||
# Monitor for failed SSH attempts to the PIX firewalls
|
||||
# $1 is the user acct
|
||||
#
|
||||
type=Single
|
||||
continue=takenext
|
||||
ptype=RegExp
|
||||
pattern=Authentication failed.*\'(\S+)\'.*/22.*$
|
||||
desc=Admin Auth FAILED -> $1
|
||||
action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
|
||||
|
||||
# Normal SSH termination
|
||||
# Works for both PIX 6.x and 7.x
|
||||
#
|
||||
# $1 is the IP of the firewall and $2 is the user acct
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*\"(\S+)\".*terminated normally
|
||||
desc=ADMIN END $1 -> $2
|
||||
action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
|
||||
|
||||
# SSH session timeout or abnormal termination
|
||||
# Works for PIX 6.x
|
||||
# May work for PIX 7.x - not tested but PIX-6-315011 is the same for 6 and 7.
|
||||
#
|
||||
# $1 is the IP of the firewall
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*disconnected by SSH server
|
||||
desc=Firewall session END - timeout $1
|
||||
action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Watch for firewall commands
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# Admin executed "write mem"
|
||||
# Works for both PIX 6.x and 7.x
|
||||
#
|
||||
# $1 is the IP of the firewall
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\s*\S+\s(\d+\.\d+\.\d+\.\d+).*write\sm.*
|
||||
desc=User wrote config to memory -> $1
|
||||
action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1
|
||||
|
||||
# Watch for HIGH CPU Utilization
|
||||
# Works for PIX 6.x
|
||||
#
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=PIX-.-211003
|
||||
desc=HIGH CPU Utilization
|
||||
action=create fwcmd_$1; add fwcmd_$1 %t; add fwcmd_$1 $0; report fwcmd_$1 /bin/mail -s "%s" email01@example.com; delete fwcmd_$1
|
||||
|
||||
80
pix-url.sec
Normal file
80
pix-url.sec
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
####################################################################
|
||||
# SEC ruleset for Monitoring Keywords
|
||||
#
|
||||
# Copyright (C) 2003-2009 Chris Sawall
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
####################################################################
|
||||
|
||||
# This particular ruleset was designed to monitor PIX syslog traffic
|
||||
# and watch for keywords in URL traffic. Starting SEC must include
|
||||
# the -intevents option.
|
||||
#
|
||||
# Currently tested for PIX 6.x
|
||||
#
|
||||
# Submitted by Chris Sawall
|
||||
# email: sawall -[at]- gmail -[dot]- com
|
||||
# Last Updated: 5/20/05
|
||||
|
||||
# Wait for SEC to start up or be restarted and then read in two lists
|
||||
# of words. The first being a list of words to watch for and alert on,
|
||||
# the second list being a list of exclusions for a suppression rule.
|
||||
#
|
||||
type=Single
|
||||
ptype=PerlFunc
|
||||
pattern=sub { if(($_[0] eq "SEC_STARTUP") || ($_[0] eq "SEC_RESTART")) { @words=`cat /root/watch4badwords`; chomp(@words); $list=join('|', @words); @ewords=`cat /root/watch4excludes`; chomp(@ewords); $excludes=join('|', @ewords);} }
|
||||
desc=$0
|
||||
context=SEC_INTERNAL_EVENT
|
||||
action=write - Set word list variable;
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Scan for certain URLs
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# Monitor and match on keywords from the exclusions file and
|
||||
# suppress reporting on them.
|
||||
#
|
||||
type=Suppress
|
||||
continue=dontcont
|
||||
ptype=PerlFunc
|
||||
pattern=sub {($_[0] =~ /($excludes)/) }
|
||||
|
||||
# Monitor for keywords and send an email alert
|
||||
#
|
||||
type=Single
|
||||
ptype=PerlFunc
|
||||
pattern=sub {($_[0] =~ /($list)/) }
|
||||
desc=Inappropriate word in URL
|
||||
action=create ssh_$1; add ssh_$1 %t; add ssh_$1 $0; report ssh_$1 /bin/mail -s "%s" email01@example.com; delete ssh_$1
|
||||
|
||||
#
|
||||
# Examples of "watch4badwords" and "watch4excludes"
|
||||
#
|
||||
# File should be a return delimited file. The
|
||||
# script read the file in literally and creates
|
||||
# an OR statement by putting a pipe (|) between
|
||||
# all of the keywords.
|
||||
#
|
||||
# Be careful on what words are being monitored.
|
||||
# The word virgin also finds virginia and alerts
|
||||
# on it.
|
||||
#
|
||||
# The following are examples of things that work:
|
||||
#
|
||||
# ----> watch4badwords
|
||||
#
|
||||
# \bvirgin\b
|
||||
# \byoung girl\b
|
||||
# \b[Pp]layboy\b
|
||||
# pr0n
|
||||
# hardcore
|
||||
#
|
||||
# ----> watch4excludes
|
||||
#
|
||||
# \b10\.10\.2\.4\b
|
||||
# \bcherry tree\b
|
||||
# cnn.com
|
||||
#
|
||||
|
||||
|
||||
45
portscan.sec
Normal file
45
portscan.sec
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
################################################################
|
||||
# Sample SEC ruleset for "PORTSCAN FROM ip1 TO ip2:port" events
|
||||
#
|
||||
# Copyright (C) 2003-2009 Risto Vaarandi
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
################################################################
|
||||
|
||||
# process "PORTSCAN FROM ip1 TO ip2:port" events, and if a certain
|
||||
# source host has scanned the same destination port on more than
|
||||
# 10 distinct destination hosts during 60 seconds, raise an alarm
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=PORTSCAN FROM ([\d.]+) TO [\d.]+:(\d+)
|
||||
context=!HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2
|
||||
continue=TakeNext
|
||||
desc=Horizontal port sweep started from source $1 to target port $2
|
||||
action=eval %o ( $portscans{"$1:$2"} = {} ); \
|
||||
create HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$2 60 \
|
||||
eval %o ( delete $portscans{"$1:$2"} )
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=PORTSCAN FROM ([\d.]+) TO ([\d.]+):(\d+)
|
||||
context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3
|
||||
continue=TakeNext
|
||||
desc=Scanned destination IP: $2
|
||||
action=eval %o ( $portscans{"$1:$3"}->{$2} = 1 ); \
|
||||
add HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 %t: %s;\
|
||||
set HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 60 \
|
||||
eval %o ( delete $portscans{"$1:$3"} )
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=PORTSCAN FROM ([\d.]+) TO ([\d.]+):(\d+)
|
||||
context=HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \
|
||||
&& =( scalar(keys(%{$portscans{"$1:$3"}})) > 10 )
|
||||
continue=DontCont
|
||||
desc=$1 has scanned more than 10 destinations
|
||||
action=report HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3 \
|
||||
mail -s 'Horizontal port sweep from $1 target port $3' root@example.com; \
|
||||
delete HORIZONTAL_PORTSWEEP_FROM_SOURCE_IP_$1_TO_TARGET_PORT_$3; \
|
||||
eval %o ( delete $portscans{"$1:$3"} )
|
||||
|
|
@ -3,6 +3,6 @@
|
|||
notifempty
|
||||
sharedscripts
|
||||
postrotate
|
||||
/usr/bin/systemctl kill --signal=USR2 --kill-whom=main sec.service 2>/dev/null || true
|
||||
[ ! -f /run/sec.pid ] || kill -USR2 `cat /run/sec.pid`
|
||||
endscript
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,8 +5,7 @@ After=syslog.target
|
|||
[Service]
|
||||
Type=forking
|
||||
PIDFile=/run/sec.pid
|
||||
ExecStart=/usr/bin/sec --detach --pid=/run/sec.pid $OPTIONS
|
||||
EnvironmentFile=/etc/sysconfig/sec
|
||||
ExecStart=/usr/bin/sec -detach -pid=/run/sec.pid -conf=/etc/sec/*.sec -input=/var/log/messages -log=/var/log/sec -intevents
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
|
|||
159
sec.spec
159
sec.spec
|
|
@ -1,16 +1,39 @@
|
|||
Name: sec
|
||||
Version: 2.9.4
|
||||
Release: 2%{?dist}
|
||||
Version: 2.7.11
|
||||
Release: 0%{?dist}
|
||||
Summary: Simple Event Correlator script to filter log file entries
|
||||
# Automatically converted from old format: GPLv2+ - review is highly recommended.
|
||||
License: GPL-2.0-or-later
|
||||
URL: https://simple-evcorr.github.io/
|
||||
Source0: https://github.com/simple-evcorr/sec/releases/download/%{version}/sec-%{version}.tar.gz
|
||||
Group: System Environment/Daemons
|
||||
License: GPLv2+
|
||||
URL: http://simple-evcorr.github.io/
|
||||
Source0: http://downloads.sourceforge.net/simple-evcorr/%{name}-%{version}.tar.gz
|
||||
Source1: sec.service
|
||||
Source2: sec@.service
|
||||
Source3: sec.logrotate
|
||||
Source4: sec.sysconfig
|
||||
Source5: conf.README
|
||||
# Example files and configuration info
|
||||
Source4: conf.README
|
||||
Source5: http://simple-evcorr.sourceforge.net/rulesets/amavisd.sec
|
||||
Source6: http://simple-evcorr.sourceforge.net/rulesets/bsd-MONITOR.sec
|
||||
Source7: http://simple-evcorr.sourceforge.net/rulesets/bsd-PHYSMOD.sec
|
||||
Source8: http://simple-evcorr.sourceforge.net/rulesets/bsd-USERACT.sec
|
||||
Source9: http://simple-evcorr.sourceforge.net/rulesets/bsd-general.sec
|
||||
Source10: http://simple-evcorr.sourceforge.net/rulesets/bsd-mpd.sec
|
||||
Source11: http://simple-evcorr.sourceforge.net/rulesets/cisco-syslog.sec
|
||||
Source12: http://simple-evcorr.sourceforge.net/rulesets/cvs.sec
|
||||
Source13: http://simple-evcorr.sourceforge.net/rulesets/dameware.sec
|
||||
Source14: http://simple-evcorr.sourceforge.net/rulesets/hp-openview.sec
|
||||
Source15: http://simple-evcorr.sourceforge.net/rulesets/labrea.sec
|
||||
Source16: http://simple-evcorr.sourceforge.net/rulesets/pix-general.sec
|
||||
Source17: http://simple-evcorr.sourceforge.net/rulesets/pix-security.sec
|
||||
Source18: http://simple-evcorr.sourceforge.net/rulesets/pix-url.sec
|
||||
Source19: http://simple-evcorr.sourceforge.net/rulesets/portscan.sec
|
||||
Source20: http://simple-evcorr.sourceforge.net/rulesets/snort.sec
|
||||
Source21: http://simple-evcorr.sourceforge.net/rulesets/snortsam.sec
|
||||
Source22: http://simple-evcorr.sourceforge.net/rulesets/ssh-brute.sec
|
||||
Source23: http://simple-evcorr.sourceforge.net/rulesets/ssh.sec
|
||||
Source24: http://simple-evcorr.sourceforge.net/rulesets/vtund.sec
|
||||
Source25: http://simple-evcorr.sourceforge.net/rulesets/windows.sec
|
||||
#
|
||||
Source26: sec.sysconfig
|
||||
BuildArch: noarch
|
||||
|
||||
BuildRequires: perl-generators
|
||||
|
|
@ -40,10 +63,19 @@ writing messages to pipes or files, etc.
|
|||
install -D -m 0755 -p sec %{buildroot}%{_bindir}/sec
|
||||
install -D -m 0644 -p sec.man %{buildroot}%{_mandir}/man1/sec.1
|
||||
install -D -m 0644 -p %{SOURCE1} %{buildroot}%{_unitdir}/sec.service
|
||||
install -D -m 0644 -p %{SOURCE2} %{buildroot}%{_unitdir}/sec@.service
|
||||
install -D -m 0644 -p %{SOURCE3} %{buildroot}%{_sysconfdir}/logrotate.d/sec
|
||||
install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/sec
|
||||
install -D -m 0644 -p %{SOURCE5} %{buildroot}%{_sysconfdir}/%{name}/README
|
||||
|
||||
# Install the example config files and readme
|
||||
install -D -m 0644 -p %{SOURCE4} %{buildroot}%{_sysconfdir}/%{name}/README
|
||||
install -d -m 0755 examples
|
||||
install -m 0644 -p %{SOURCE5} %{SOURCE6} %{SOURCE7} %{SOURCE8} \
|
||||
%{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} \
|
||||
%{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} \
|
||||
%{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} \
|
||||
%{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} \
|
||||
%{SOURCE25} examples/
|
||||
install -m 0644 -p %{SOURCE2} sec@.service
|
||||
install -m 0644 -p %{SOURCE26} sec.sysconfig
|
||||
|
||||
# Remove executable bits because these files get packed as docs
|
||||
chmod 0644 contrib/convert.pl contrib/swatch2sec.pl
|
||||
|
|
@ -57,114 +89,19 @@ chmod 0644 contrib/convert.pl contrib/swatch2sec.pl
|
|||
%postun
|
||||
%systemd_postun_with_restart sec.service
|
||||
|
||||
%clean
|
||||
rm -rf %{buildroot}
|
||||
|
||||
%files
|
||||
%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl
|
||||
%defattr(-,root,root,-)
|
||||
%doc ChangeLog COPYING README contrib/convert.pl contrib/itostream.c contrib/swatch2sec.pl examples sec@.service sec.sysconfig
|
||||
%config(noreplace) %{_sysconfdir}/%{name}
|
||||
%config(noreplace) %{_sysconfdir}/logrotate.d/sec
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/sec
|
||||
%{_bindir}/sec
|
||||
%{_mandir}/man1/sec.1*
|
||||
%{_unitdir}/sec.service
|
||||
%{_unitdir}/sec@.service
|
||||
|
||||
%changelog
|
||||
* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.4-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
|
||||
|
||||
* Thu Feb 12 2026 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.4-1
|
||||
- New upstream release
|
||||
- Use systemctl kill
|
||||
|
||||
* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.3-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
|
||||
|
||||
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.3-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.3-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Sat Nov 02 2024 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.3-1
|
||||
- New upstream release
|
||||
|
||||
* Fri Jul 26 2024 Miroslav Suchý <msuchy@redhat.com> - 2.9.2-5
|
||||
- convert license to SPDX
|
||||
|
||||
* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.2-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.2-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.2-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Mon Jun 05 2023 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.2-1
|
||||
- New upstream release
|
||||
|
||||
* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.1-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.1-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Wed May 04 2022 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.1-1
|
||||
- New upstream release
|
||||
|
||||
* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.0-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.0-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Thu May 13 2021 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.9.0-1
|
||||
- New upstream release
|
||||
|
||||
* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.8.3-4
|
||||
- Rebuilt for updated systemd-rpm-macros
|
||||
See https://pagure.io/fesco/issue/2583.
|
||||
|
||||
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.3-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.3-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Sat May 2 2020 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.3-1
|
||||
- New upstream release
|
||||
|
||||
* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.2-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.2-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
|
||||
* Mon Jun 3 2019 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.2-1
|
||||
- New upstream release
|
||||
- Clean up spec file
|
||||
- Added an environment file /etc/sysconfig/sec in order to specify command line options
|
||||
|
||||
* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.1-1
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
|
||||
* Wed Oct 3 2018 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.1-0
|
||||
- New upstream release
|
||||
|
||||
* Sun Sep 2 2018 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.8.0-0
|
||||
- New upstream release
|
||||
|
||||
* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.12-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
|
||||
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.12-1
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||
|
||||
* Wed Dec 13 2017 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.12-0
|
||||
- New upstream release
|
||||
|
||||
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.11-1
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
||||
|
||||
* Sun Feb 5 2017 Stefan Schulze Frielinghaus <stefansf@fedoraproject.org> - 2.7.11-0
|
||||
- New upstream release
|
||||
|
||||
|
|
|
|||
|
|
@ -1,9 +1,7 @@
|
|||
# Command line options for SEC
|
||||
|
||||
OPTIONS="--conf=/etc/sec/*.sec --input=/var/log/messages --log=/var/log/sec --intevents"
|
||||
|
||||
# This is an example config if multiple instances of SEC should be started.
|
||||
# These settings should be used together with the systemd service file
|
||||
# This is an example config file if multiple instances of SEC should be started.
|
||||
# This file should be located in
|
||||
# /etc/sysconfig/sec
|
||||
# and used together with the systemd service file
|
||||
# sec@.service
|
||||
# which allows to run multiple sec instances.
|
||||
#
|
||||
|
|
@ -14,6 +12,6 @@ OPTIONS="--conf=/etc/sec/*.sec --input=/var/log/messages --log=/var/log/sec --in
|
|||
# For further configuration options, consult the systemd file:
|
||||
# /lib/systemd/system/sec@.service
|
||||
|
||||
#OPTIONS_FOO="--conf=/etc/sec/FOO/*.sec --input=/var/log/secure --log=/var/log/sec-FOO --intevents"
|
||||
OPTIONS_FOO="-input=/var/log/messages"
|
||||
|
||||
#OPTIONS_BAR="--conf=/etc/sec/BAR/*.sec --input=/var/log/maillog --log=/var/log/sec-BAR --intevents"
|
||||
OPTIONS_BAR="-input=/var/log/syslog"
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ After=syslog.target
|
|||
[Service]
|
||||
Type=forking
|
||||
PIDFile=/run/sec-%I.pid
|
||||
ExecStart=/usr/bin/sec --detach --pid=/run/sec-%I.pid $OPTIONS_%I
|
||||
ExecStart=/usr/bin/sec -detach -pid=/run/sec-%I.pid -conf=/etc/sec/%I/*.sec -input=/var/log/messages -log=/var/log/sec-%I -intevents $OPTIONS_%I
|
||||
EnvironmentFile=/etc/sysconfig/sec
|
||||
|
||||
[Install]
|
||||
|
|
|
|||
163
snort.sec
Normal file
163
snort.sec
Normal file
|
|
@ -0,0 +1,163 @@
|
|||
####################################################################
|
||||
# Sample SEC ruleset for Snort IDS
|
||||
#
|
||||
# Copyright (C) 2003-2009 Risto Vaarandi
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
####################################################################
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Handle portscans
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# For every completed portscan, add an entry to the PORTSCAN_REPORT;
|
||||
# also generate a meta-event ACTIVITY_FROM for the IP
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=End of portscan from (([\d.]+).*)
|
||||
desc=Portscan from $1
|
||||
action=add PORTSCAN_REPORT %t: %s; event ACTIVITY_FROM_$2: %s
|
||||
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Recognize snort alert message and generate corresponding SEC event
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# recognize snort alert message; also generate
|
||||
# a meta-event ACTIVITY_FROM for the IP
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=snort(?:\[\d+\])?: \[[0-9:]+\] (.+|!Malware|!MALWARE) \[(.+)\] \[.*Priority: (\d+)\]: \S+ ([\d.]+):?\d* -> ([\d.]+):?\d*
|
||||
desc=PRIORITY $3 INCIDENT FROM $4 TO $5: $1 [$2]
|
||||
action=event %s; event ACTIVITY_FROM_$4: $1
|
||||
|
||||
|
||||
## Detect if it's an unwanted event in snort
|
||||
#type=Single
|
||||
#ptype=RegExp
|
||||
#pattern=(MALWARE|Malware)
|
||||
#desc=$0
|
||||
#action=create UNWANTED_EVENT
|
||||
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Handle priority 1 incidents
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# Detect the beginning of priority 1 attack from a certain source IP,
|
||||
# and send a warning e-mail message that a new attack has begun;
|
||||
# also create a context for storing a detailed information about the attack
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=PRIORITY 1 INCIDENT FROM ([\d.]+) TO [\d.]+:
|
||||
context=ATTACK_FROM_$1
|
||||
continue=TakeNext
|
||||
desc=Priority 1 attack started from $1
|
||||
action=create ATTACK_FROM_$1; add ALERT_REPORT %t: %s; pipe '%t: %s' \
|
||||
/usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1' alerts@example.com
|
||||
|
||||
|
||||
# For every priority 1 incident, add an entry to the context by its IP;
|
||||
# if the IP has been quiet for 5 minutes, report the whole attack
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=PRIORITY 1 INCIDENT FROM ([\d.]+) TO ([\d.]+): (.+)
|
||||
context=ATTACK_FROM_$1
|
||||
continue=TakeNext
|
||||
desc=Priority 1 incident from $1 to $2: $3
|
||||
action=add ATTACK_FROM_$1 %t: %s; \
|
||||
set ATTACK_FROM_$1 300 ( report ATTACK_FROM_$1 \
|
||||
/usr/bin/mail -s 'NOC: SNORT: priority 1 attack from $1 (report)' alerts@example.com )
|
||||
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Handle incidents by thresholding
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# Count how many _certain type_ of incidents are coming from one source
|
||||
# if the threshold has been crossed, reset the counting operation started
|
||||
# by the next rule, in order to avoid duplicate alerts for the same IP
|
||||
|
||||
type=SingleWithThreshold
|
||||
ptype=RegExp
|
||||
pattern=PRIORITY (\d+) INCIDENT FROM ([\d.]+) TO [\d.]+: (.+)
|
||||
continue=TakeNext
|
||||
desc=Snort has seen >= 30 priority $1 incidents from $2: $3
|
||||
action=add ALERT_REPORT %t: %s; \
|
||||
reset +1 Snort has seen >= 150 incidents from $2; \
|
||||
create TURNOFF_$2 3600
|
||||
thresh=30
|
||||
window=3600
|
||||
|
||||
|
||||
# Count how many incidents come from one source
|
||||
|
||||
type=SingleWithThreshold
|
||||
ptype=RegExp
|
||||
pattern=PRIORITY \d+ INCIDENT FROM ([\d.]+) TO [\d.]+:
|
||||
context=!TURNOFF_$1
|
||||
desc=Snort has seen >= 150 incidents from $1
|
||||
action=add ALERT_REPORT %t: %s
|
||||
thresh=150
|
||||
window=7200
|
||||
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Report IPs that have been active for some time
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# Set up activity contexts for the IP; if the IP has been active for 2 hours,
|
||||
# and there have been no gaps longer than 30 minutes, report its activities
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=ACTIVITY_FROM_([\d.]+):
|
||||
context=!ACTIVITY_LIST_FOR_$1
|
||||
continue=TakeNext
|
||||
desc=Create activity contexts for $1
|
||||
action=create ACTIVITY_LIST_FOR_$1_LIFETIME; \
|
||||
create ACTIVITY_LIST_FOR_$1 7200 ( report ACTIVITY_LIST_FOR_$1 \
|
||||
/usr/bin/mail -s 'SNORT: $1 has been active for 2 hours' alerts@example.com; \
|
||||
delete ACTIVITY_LIST_FOR_$1_LIFETIME )
|
||||
|
||||
|
||||
# Add the activity event to the context of a given IP, and extend
|
||||
# the lifetime of activity contexts for 30 minutes for the IP
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=ACTIVITY_FROM_([\d.]+): (.*)
|
||||
context=ACTIVITY_LIST_FOR_$1
|
||||
desc=Activity from $1: $2
|
||||
action=add ACTIVITY_LIST_FOR_$1 %t: %s; \
|
||||
set ACTIVITY_LIST_FOR_$1_LIFETIME 1800 ( delete ACTIVITY_LIST_FOR_$1 )
|
||||
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Send reports every day at 9:00 am
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# send daily report about regular alerts
|
||||
|
||||
type=Calendar
|
||||
time=0 12 * * *
|
||||
desc=Sending alert report...
|
||||
action=report ALERT_REPORT \
|
||||
/usr/bin/mail -s 'SNORT: Hourly alert report' alerts@example.com; \
|
||||
delete ALERT_REPORT
|
||||
|
||||
|
||||
# send daily report about portscans
|
||||
|
||||
type=Calendar
|
||||
time=0 9 * * *
|
||||
desc=Sending portscan report...
|
||||
action=report PORTSCAN_REPORT \
|
||||
/usr/bin/mail -s 'SNORT: daily portscan report' alerts@example.com; \
|
||||
delete PORTSCAN_REPORT
|
||||
|
||||
77
snortsam.sec
Normal file
77
snortsam.sec
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
#############################################################################
|
||||
# Snort SAM events
|
||||
#
|
||||
# Copyright (C) 2003-2009 Matt Jonkman
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#############################################################################
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Error: Could not bind socket.
|
||||
desc = $0
|
||||
action=pipe '$1 Snortsam Bind Failed -- NEEDS ATTENTION!: %s' /usr/bin/mail -s "Snortsam Bind Failure: NEEDS ATTENTION on $1" alerts@example.com
|
||||
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]+) root: (.*), email, Error: \[email\] Did not receive a response waiting for banner on mail server at (.*)
|
||||
desc = $0
|
||||
action=add SNORTSAM_REPORT $1 Couldn't email through $3 : %s
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]+) snortsam, Extending block for host ([A-z._0-9-]*) completely for (.*)
|
||||
desc = $0
|
||||
action=add SNORTSAM_REPORT $1 Extending Block for $3 for $4
|
||||
|
||||
|
||||
#type=single
|
||||
#ptype=regexp
|
||||
#pattern=([A-Za-z0-9._-]+)snortsam\[([0-9]+)\]: [*], [:0-9]+, -, ipf, (.*) Failed
|
||||
#desc = Snortsam ipf error
|
||||
#action=pipe '$1 Snortsam IPF Command Failed' /usr/bin/mail -s "%s" alerts@example.com
|
||||
##action=add SNORTSAM_REPORT ERROR $1 IPF Command Failure: $2
|
||||
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Starting to listen for Snort alerts.
|
||||
desc = $0
|
||||
action=add SNORTSAM_REPORT $1 Snortsam Startup: %s
|
||||
|
||||
|
||||
#type=single
|
||||
#ptype=regexp
|
||||
#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Removing (.*) complete block for host (.*).
|
||||
#desc = $0
|
||||
#action=add SNORTSAM_REPORT $1 Snortsam Removing Block: %s
|
||||
|
||||
#type=single
|
||||
#ptype=regexp
|
||||
#pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Blocking host (.*) completely for (.*) \((Sig_ID: \d+\))\.
|
||||
#desc = $0
|
||||
#action=add SNORTSAM_REPORT $1 Snortsam Block: %s
|
||||
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]+) root: (.*) ipf, Error: Command (.*) Failed
|
||||
desc = $0
|
||||
action=pipe '$1 Snortsam IPF Command Failed: $1 $2 $3' /usr/bin/mail -s "Snortsam IPF Command Failed on $1" alerts@example.com
|
||||
|
||||
type=single
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]+) root: (.*) snortsam, Snortsam Station .* using wrong password, trying to resync.
|
||||
desc = $0
|
||||
action=pipe '$1 Snortsam Password Failure: $1' /usr/bin/mail -s "Snortsam Password Failure on $1" alerts@example.com
|
||||
|
||||
#Send hourly snortsam report
|
||||
|
||||
type=Calendar
|
||||
time=0 * * * *
|
||||
desc=Sending snortsam report...
|
||||
action=report SNORTSAM_REPORT \
|
||||
/usr/bin/mail -s 'SNORTSAM report' alerts@example.com; \
|
||||
delete SNORTSAM_REPORT
|
||||
2
sources
2
sources
|
|
@ -1 +1 @@
|
|||
SHA512 (sec-2.9.4.tar.gz) = e049ea61e52420faddc2ad3373d9ec65cc6187d59e89537d919eb0342688e494c3d9db334347dbaf9a42260930c99756d46ed3f9f015a38bd95f6959ded047d9
|
||||
SHA512 (sec-2.7.11.tar.gz) = 2de3c131f85029a91e7db1405be236b8ef31454bdffa28d5a2f912af73a2d0b0fbfb37a2f1548f7899ae3c43248e9c20084b7cb55a6b309c00d103d8b8019e80
|
||||
|
|
|
|||
69
ssh-brute.sec
Normal file
69
ssh-brute.sec
Normal file
|
|
@ -0,0 +1,69 @@
|
|||
################## ssh brute force attack blocker
|
||||
# Copyright (C) 2003-2009 Mark Bergman
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
##################
|
||||
#
|
||||
# This sec ruleset monitors syslog messages for indications that an ssh brute-force
|
||||
# login attack is underway. The trigger is an ssh login failure.
|
||||
#
|
||||
# If 4 additional syslog messages about ssh login failures from the same
|
||||
# source address are received within next 1 minute, an iptables firewall
|
||||
# rule is added to block access from the source IP.
|
||||
#
|
||||
# After that, the correlation operation waits until no ssh login failure
|
||||
# syslog messages from the source IP have been received from the router
|
||||
# during the last 2 hours, and then the iptables rule is removed. By
|
||||
# definition, once the IP is blocked, there will be no more connection
|
||||
# attempt failures logged by ssh (ie., packets will be dropped by the kernel
|
||||
# before they reach the syslog daemon), so the rule will be flushed after
|
||||
# 2 hours.
|
||||
#
|
||||
# Vulnerabilities of this ruleset are:
|
||||
#
|
||||
# persistent firewall rules:
|
||||
# if the sec daemon crashes or is restarted, any existing rules
|
||||
# will not be removed after 2hours
|
||||
#
|
||||
# window=60 # sliding window (1 minute) for initial event match
|
||||
# thresh=4 # number of events (ssh login failures from a given IP) that must
|
||||
# # occur within the window period in order to trigger the action
|
||||
#
|
||||
# window2=7200 # sliding window (2 hours) for the second event match
|
||||
# thresh2=0
|
||||
###############
|
||||
# RCSversion="$Header: /home/bergman/RCS/ssh_block.sec,v 1.3 2006/05/02 04:18:44 bergman Exp bergman $"
|
||||
#
|
||||
# Representative log file entries:
|
||||
# Aug 28 04:43:03 10.1.1.18 sshd(pam_unix)[22344]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=www.ace.ne.jp
|
||||
# Aug 28 04:43:03 host sshd[22568]: Failed password for illegal user library from 210.230.187.218 port 55019 ssh2
|
||||
# Aug 28 04:42:28 www.somehost.net sshd[9395]: Failed password for illegal user mysql from 210.230.187.218 port 52857 ssh2
|
||||
# Aug 28 04:42:28 host sshd[22509]: Failed password for root from 210.230.187.218 port 52960 ssh2
|
||||
# Aug 28 04:42:32 www.somehost.net sshd[9397]: Failed password for illegal user oracle from 210.230.187.218 port 53212 ssh2
|
||||
# Aug 28 04:42:32 host sshd[22510]: Failed password for illegal user admin from 2 10.230.187.218 port 53243 ssh2
|
||||
|
||||
#
|
||||
type=SingleWith2Thresholds
|
||||
ptype=RegExp
|
||||
pattern=sshd.*: authentication failure[ ;].* rhost=(\S+)
|
||||
desc=Multiple failed ssh authentication attempts from $1
|
||||
action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP )
|
||||
window=60
|
||||
thresh=4
|
||||
desc2=Pruning iptables firewall rule blocking ssh from $1
|
||||
action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP )
|
||||
window2=7200
|
||||
thresh2=0
|
||||
|
||||
type=SingleWith2Thresholds
|
||||
ptype=RegExp
|
||||
pattern=sshd.*: Failed password for.* user .* from (\S+)
|
||||
desc=Multiple ssh password failures from $1
|
||||
action=logonly ; shellcmd ( /usr/local/sbin/ipt-add -I FORWARD -s $1 -p tcp --dport 22 -j DROP ; /usr/local/sbin/ipt-add -I INPUT -s $1 -p tcp --dport 22 -j DROP )
|
||||
window=60
|
||||
thresh=4
|
||||
desc2=Pruning iptables firewall rule blocking ssh from $1
|
||||
action2=logonly ; shellcmd ( /sbin/iptables -D FORWARD -s $1 -p tcp --dport 22 -j DROP ; sleep 2; /sbin/iptables -D INPUT -s $1 -p tcp --dport 22 -j DROP ; sleep 2)
|
||||
window2=7200
|
||||
thresh2=0
|
||||
260
ssh.sec
Normal file
260
ssh.sec
Normal file
|
|
@ -0,0 +1,260 @@
|
|||
###########################################################################
|
||||
# SEC ruleset to accumulate errors from a parent and child sshd process
|
||||
# into a single context. This allows reporting of the authenticated
|
||||
# user information with the error's generated by the child sshd process.
|
||||
#
|
||||
# Copyright (C) 2003-2009 John P. Rouillard
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
###########################################################################
|
||||
|
||||
# note handling of deferred reporting until after tie events received
|
||||
# is still in flux. My old rules hanlded it by resubmitting all the
|
||||
# events, but it didn't handle the parent defered reporting
|
||||
# events. This way is cleaner, but not tested very well.
|
||||
|
||||
type=single
|
||||
continue=dontcont
|
||||
ptype=Nregexp
|
||||
pattern=sshd|SSHD
|
||||
desc=filter out non-sshd events
|
||||
action=none
|
||||
|
||||
type=single
|
||||
continue=dontcont
|
||||
ptype=TValue
|
||||
pattern=TRUE
|
||||
desc=guard for already handled
|
||||
action=logonly
|
||||
context = [EVENT_PROCESSED]
|
||||
|
||||
type=single
|
||||
continue=takenext
|
||||
ptype=TValue
|
||||
pattern=TRUE
|
||||
desc=We will handle.
|
||||
action=create EVENT_PROCESSED
|
||||
|
||||
## Recognize the start of an ssh session
|
||||
# link parent and child event contexts.
|
||||
#
|
||||
#type=PairWithWindow
|
||||
#continue=takenext
|
||||
#desc=Recognize ssh session start for $1[$2]
|
||||
#ptype=regexp
|
||||
#pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Connection from ([0-9.]+) port [0-9]+
|
||||
#action=pipe session_log_$1_$2 \
|
||||
# /usr/bin/mail -s "ssh failed to generate tie event for $1" alerts@example.com
|
||||
#desc2=Link parent and child contexts
|
||||
#ptype2=regexp
|
||||
#pattern2=$1 [A-z0-9]+\[[0-9]+\]: \[[^]]+\] SSHD child process +([0-9]+) spawned by $2
|
||||
#action2=copy session_log_%1_$1 %b; \
|
||||
# delete session_log_%1_$1; \
|
||||
# alias session_log_%1_%2 session_log_%1_$1; \
|
||||
# add session_log_%1_$1 $0; \
|
||||
# event 0 "sshd: Report %1_$1 if needed"; \
|
||||
# alias session_log_owner_%1_%2 session_log_owner_%1_$1 ;\
|
||||
# create tie_event_received_%1_%2 ;\
|
||||
# alias tie_event_received_%1_%2 tie_event_received_%1_$1 ;\
|
||||
# delete ssh_tie_event_needed_%1
|
||||
#window=60
|
||||
|
||||
## recognize login event and save username for later use
|
||||
type=single
|
||||
desc=Start login timer
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Accepted (publickey|password) for ([A-z0-9_-]+) from [0-9.]+ port [0-9]+ (.*)
|
||||
action=add session_log_$1_$2 $0; add session_log_owner_$1_$2 $4
|
||||
|
||||
# handle logout
|
||||
type=single
|
||||
desc=Recognize ssh session end
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]: \[[^]]+\] Closing connection to ([0-9.]+)
|
||||
action= delete session_log_$1_$2; delete session_log_owner_$1_$2; \
|
||||
delete tie_event_received_$1_$2
|
||||
|
||||
## ignore ssh IPV6 errors.
|
||||
#
|
||||
# Example input:
|
||||
# Nov 3 06:34:25 corphost sshd[5961]: [ID 800047 auth.error] error: \
|
||||
# connect_to ::1 port 5910: Network is unreachable
|
||||
#
|
||||
type=suppress
|
||||
desc = ignore IPV6 errors from ssh
|
||||
ptype=regexp
|
||||
pattern=sshd\[[0-9]+\]: \[ID 800047 auth.error\] error: connect_to ::1 port [0-9]+: Network is unreachable
|
||||
|
||||
# because the tie command can come after critical errors are reported,
|
||||
# we provide a way to generate a report on demand.
|
||||
type=single
|
||||
desc=Report immediate on request.
|
||||
ptype=regexp
|
||||
pattern=^sshd: Report (.*) if needed$
|
||||
context = session_log_report_$1
|
||||
action= report session_log_$1 /usr/bin/mailx -s "sshd error on $1" alerts@example.com ;\
|
||||
delete session_log_report_$1
|
||||
|
||||
type=suppress
|
||||
desc=Discard report immediate event on request.
|
||||
ptype=regexp
|
||||
pattern=^sshd: Report (.*) if needed$
|
||||
|
||||
# INSERT IMMEDIATE REPORT RULES HERE
|
||||
# rules that should report problems immediately should go here.
|
||||
# e.g. channel_setup_fwd_listener: cannot listen to port: 1521
|
||||
# where port is < 1024, or is some other well known port indicating
|
||||
# possible hacking.
|
||||
#
|
||||
# We have five possible cases:
|
||||
# Event is from parent process and no info from child process is needed.
|
||||
# Report normally.
|
||||
# Event is from parent process and info from child process is needed,
|
||||
# and tie event received (context tie_event_received_<host>_<pid>
|
||||
# exists). Report normally.
|
||||
# Event is from parent process and info from child process is needed,
|
||||
# but tie event not received (context tie_event_received_<host>_<pid>
|
||||
# does not exist).
|
||||
# Report using child event as trigger.
|
||||
# Event that has to be reported is from the child process and
|
||||
# we have received the tie event (context
|
||||
# tie_event_received_<host>_<pid> exists). Just report normally.
|
||||
# Event that has to be reported is from the child process and
|
||||
# we haven't received the tie event (context
|
||||
# tie_event_received_<host>_<pid> does not exist). Defer reporting
|
||||
# until after tie event by setting context
|
||||
# session_log_report_<hostname>_<child pid>.
|
||||
#
|
||||
# We may need two rules for each event if the event can come before the tie
|
||||
# event. One rule checks to see if the context ssh_tie_event_needed_$1
|
||||
# where $1 is the reporting host. If so then it needs to set the context
|
||||
# session_log_report_<host>_<pid> if generated by the child process.
|
||||
|
||||
# Note we get a less specific report this way. It should be retooled
|
||||
# to generate a context that the report rule can simply obsolete.
|
||||
# These events are generated by the child.
|
||||
type=single
|
||||
continue=takenext
|
||||
desc = record ssh channel_setup_fwd_listener error for $1 port < 1025
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*)
|
||||
context = $3 < 1025 && ! tie_event_received_$1_$2
|
||||
action = add session_log_$1_$2 $0 ; \
|
||||
create session_log_report_$1_$2
|
||||
|
||||
type=single
|
||||
continue=takenext
|
||||
desc = record ssh channel_setup_fwd_listener error for $1 port < 1025
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port: ([0-9]*)
|
||||
context = $3 < 1025 && tie_event_received_$1_$2
|
||||
action = add session_log_$1_$2 $0 ; \
|
||||
report session_log_report_$1_$2 \
|
||||
/usr/bin/mailx -s "sshd bind < 1025 on $1" alerts@example.com
|
||||
|
||||
# end immediate rules here
|
||||
|
||||
## report/record ssh bind errors.
|
||||
# Record ssh bind errors in the session log. Don't report unless
|
||||
# we have more than 5 of them in a 10 minute period. Then go and
|
||||
# find out why they are occurring. Probably a frustrated user
|
||||
# getting the -L options wrong.
|
||||
#
|
||||
# We record all events until a 10 minute period has passed with no
|
||||
# events. If the threshold is exceeded, then we report all events
|
||||
# recorded during the 10 minute rolling window.
|
||||
#
|
||||
# We also group channel_setup_fwd_listener with this.
|
||||
#
|
||||
# Example input:
|
||||
# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: bind: \
|
||||
# Address already in use
|
||||
#
|
||||
type=single
|
||||
continue=takenext
|
||||
desc = record ssh bind error for $1
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use
|
||||
action = add session_log_$1_$2 $0 ; \
|
||||
set ssh_port_forward_errors_$1_$2 600
|
||||
|
||||
type=singlewiththreshold
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: bind: Address already in use
|
||||
context = ssh_port_forward_errors_$1_$2
|
||||
desc = send report on ssh forward errors if pass threshold (bind)
|
||||
action = report session_log_$1_$2 \
|
||||
/usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com; \
|
||||
delete ssh_port_forward_errors_$1_$2
|
||||
thresh=5
|
||||
window=600
|
||||
|
||||
# Similar idea to ssh bind errors except on
|
||||
# channel_setup_fwd_listener errors. If we have more than 5
|
||||
# of them in a 10 minute period, go and find out why they are occurring.
|
||||
# Probably a frustrated user getting the -L options wrong.
|
||||
#
|
||||
# We record all events until a 10 minute period has passed with no
|
||||
# events. If the threshold is exceeded, then we report all events
|
||||
# recorded during the 10 minute rolling window.
|
||||
#
|
||||
# Example input:
|
||||
# Nov 4 23:36:38 example sshd[1131]: [ID 800047 auth.error] error: \
|
||||
# channel_setup_fwd_listener: cannot listen to port: 1521
|
||||
#
|
||||
|
||||
type=single
|
||||
continue=takenext
|
||||
desc = record ssh channel_setup_fwd_listener error for $1
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port:
|
||||
action = add session_log_$1_$2 $0 ; \
|
||||
set ssh_channel_setup_errors_$1_$2 600
|
||||
|
||||
type=singlewiththreshold
|
||||
ptype=regexp
|
||||
pattern=([A-z._0-9-]*) sshd\[([0-9]+)\]: \[ID 800047 auth.error\] error: channel_setup_fwd_listener: cannot listen to port:
|
||||
context = ssh_channel_setup_errors_$1_$2
|
||||
desc = send report on ssh channel setup errors
|
||||
action = report session_log_$1_$2 \
|
||||
/usr/bin/mailx -s "ssh port forward errors host $1" alerts@example.com ; \
|
||||
delete ssh_channel_setup_errors_$1_$2
|
||||
thresh=5
|
||||
window=600
|
||||
|
||||
# Gather random sshd errors and report after 5 minutes
|
||||
#
|
||||
# This could have been set up a number of different ways, but I have one
|
||||
# rule to create the context only when it doesn't exist, and another rule
|
||||
# that adds to the context. The create rule also sets the 5 minute timeout
|
||||
# that will cause the event store to be delivered when it is deleted.
|
||||
#
|
||||
# Example input:
|
||||
# Nov 3 09:48:56 example sshd[7871]: [ID 800047 auth.crit] fatal: \
|
||||
# Timeout before authentication for 37.117.12.201
|
||||
#
|
||||
type=single
|
||||
continue = takenext
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]+) sshd\[([0-9]+)\]:
|
||||
desc = create context to report ssh errors for host $1 pid $2 in 5 minutes
|
||||
context = ! session_log_5min_timer_$1_$2
|
||||
action = create session_log_5min_timer_$1_$2 300 report session_log_$1_$2 \
|
||||
/usr/bin/mailx -s "ssh errors for host $1 pid $2" alerts@example.com
|
||||
|
||||
type=single
|
||||
continue = dontcont
|
||||
ptype=regexp
|
||||
pattern=([A-Za-z0-9._-]*) sshd\[([0-9]+)\]:
|
||||
desc = gather ssh errors for host $1
|
||||
action = add session_log_$1_$2 $0
|
||||
|
||||
# Remove the handled context if we reach this point.
|
||||
type=single
|
||||
continue=dontcont
|
||||
ptype=TValue
|
||||
pattern=TRUE
|
||||
desc=delete EVENT_PROCESSED
|
||||
action=delete EVENT_PROCESSED
|
||||
|
||||
67
vtund.sec
Normal file
67
vtund.sec
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
#############################################################################
|
||||
# VTUN events
|
||||
#
|
||||
# Copyright (C) 2003-2009 Matt Jonkman
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#############################################################################
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (\S+)\[\S\] opened
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT %t: %s;
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: BlowFish encryption initialized
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT %t: VTUN Tunnel Opened on $1
|
||||
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: VTun client ver\s+(.*)
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT %t: VTUN Server Started on $1 version $2
|
||||
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connecting to (.*)
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT VTUN %s
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Denied connection from (\d+\.\d+\.\d+\.\d+):\d+
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT %t: VTUN Connection DENIED by $1 from $2
|
||||
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connection denied by (.*)
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT %t: VTUN Connection DENIED by $2 for $1
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Exit
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT %t: VTUN Exit on $1
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Can't resolv server address: (.*)
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT %t: VTUN Cannot Resolve Target $2 on $1
|
||||
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (/S+) closed
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT %t: VTUN Session $2 Closed on $1
|
||||
|
||||
44
windows.sec
Normal file
44
windows.sec
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
#############################################################################
|
||||
# Windows events
|
||||
#
|
||||
# Copyright (C) 2003-2009 Matt Jonkman
|
||||
# This is free software. You may redistribute copies of it under the terms of
|
||||
# the GNU General Public License version 2.
|
||||
# There is NO WARRANTY, to the extent permitted by law.
|
||||
#############################################################################
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+ESE: N/A: Information Store \(\d+\) Online defragmentation (.*)
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT EXCHANGE DEFRAG%t: %s;
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Userenv: NT AUTHORITY\\SYSTEM: Windows cannot determine the user or computer name\. Return value \(1326\).
|
||||
desc=$0
|
||||
action=add GENERAL_REPORT %t: %s
|
||||
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Locked Out: Target Account Name: (\S+) .*
|
||||
desc=$0
|
||||
action=pipe '$1 Windows Account Lockout: %s' /usr/bin/mail -s "Windows Account Locked on $1" alerts@example.com
|
||||
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+Security: \\Everyone: User Account Changed: (/S+)\. .*
|
||||
desc=$0
|
||||
action=pipe '$1 Windows Account Change: %s' /usr/bin/mail -s "Windows Account Changed on $1: $2" alerts@example.com
|
||||
|
||||
|
||||
type=Single
|
||||
ptype=RegExp
|
||||
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+NetBT: N\/A: A duplicate name has been detected on the TCP network\. .*
|
||||
desc=$0
|
||||
action=pipe '$1 Duplicate Netbios Name Detected: %s' /usr/bin/mail -s "Duplicate Netbios Name on $1" alerts@example.com
|
||||
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue