Author: yoann
Date: 2008-11-05 09:43:13 +0100 (Wed, 05 Nov 2008)
New Revision: 11081
Modified:
prelude-lml/trunk/plugins/pcre/ruleset/cisco-vpn.rules
Log:
Match Authentication Rejected message even thought the server field
does not contain a word (fix #328).
Modified: prelude-lml/trunk/plugins/pcre/ruleset/cisco-vpn.rules
===================================================================
--- prelude-lml/trunk/plugins/pcre/ruleset/cisco-vpn.rules 2008-11-04 13:42:34 UTC (rev 11080)
+++ prelude-lml/trunk/plugins/pcre/ruleset/cisco-vpn.rules 2008-11-05 08:43:13 UTC (rev 11081)
@@ -68,7 +68,7 @@
last
#LOG:Oct 29 19:18:20 vpn 1793 10/29/2003 19:18:20.190 SEV=3 AUTH/5 RPT=6 12.34.56.78 Authentication rejected: Reason = Invalid password handle = 66, server = Internal, user = gene.gomez, domain = <not specified>
-regex=([\d\.]+) Authentication rejected: Reason = (.+) handle = \d+, server = (\w+), user = (\S+), domain = (.+); \
+regex=([\d\.]+) Authentication rejected: Reason = (.+) handle = \d+, server = (\S+), user = (\S+), domain = (.+); \
classification.text=VPN user authentication; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=vpn_id; \
@@ -77,7 +77,7 @@
classification.reference(1).meaning=vpn_severity; \
classification.reference(1).name=3; \
id=301; \
- revision=3; \
+ revision=4; \
analyzer(0).name=VPN Concentrator; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=VPN; \
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.