prelude-lml/master: Change the Cisco ASA urls to the new location
[email protected] Wed, 1 Jul 2009 11:39:27 +0200 (CEST)
| Newsgroups | gmane.comp.security.ids.prelude.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit 6099128d5b8ff1d2ac8dfa7a799846b4ce601b63
Author: Sebastien Tricaud <toady@kirk.(none)>
Date: Wed Jul 1 11:37:07 2009 +0200
Change the Cisco ASA urls to the new location
========================================
plugins/pcre/ruleset/cisco-asa.rules | 94 +++++++++++++++++-----------------
1 files changed, 47 insertions(+), 47 deletions(-)
========================================
diff --git a/plugins/pcre/ruleset/cisco-asa.rules b/plugins/pcre/ruleset/cisco-asa.rules
index e38224d..b977420 100644
--- a/plugins/pcre/ruleset/cisco-asa.rules
+++ b/plugins/pcre/ruleset/cisco-asa.rules
@@ -36,13 +36,13 @@ regex=-(4000\d\d): IDS:(\d+) (.+) from ([\d\.]+) to ([\d\.]+) on interface (\S+)
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=$1; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp2266063; \
classification.reference(1).origin=vendor-specific; \
classification.reference(1).meaning=csids_id; \
classification.reference(1).name=$1; \
- classification.reference(1).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(1).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp2266063; \
id=200; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -62,9 +62,9 @@ regex=-605005: Login permitted from ([\d\.]+)\/(\d+) to (\S+):([\d\.]+)\/(\S+) f
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=605005; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1284894; \
id=201; \
- revision=5; \
+ revision=6; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -91,9 +91,9 @@ regex=-111008: User '(\S+)' executed the 'enable' command; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=111008; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1280203; \
id=202; \
- revision=5; \
+ revision=6; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -115,9 +115,9 @@ regex=-111001: Begin configuration: (\S+) writing to (\S+); \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=111001; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wpxref46365/1/; \
id=203; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -140,9 +140,9 @@ regex=-611103: User logged out: Uname: (\S+); \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=611103; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1285015; \
id=204; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -161,9 +161,9 @@ regex=-605004: Login denied from ([\d\.]+)\/(\d+) to (\S+):([\d\.]+)\/(\S+) for
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=605004; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1284886; \
id=205; \
- revision=5; \
+ revision=6; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -190,9 +190,9 @@ regex=-308001: PIX (\S+) enable password incorrect for (\d+) tries \(from (.+)\)
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=308001; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1280990; \
id=206; \
- revision=5; \
+ revision=6; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -220,9 +220,9 @@ regex=-315011: SSH session from ([\d\.]+) on interface (\S+) for user "" disconn
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=315001; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1281091; \
id=207; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -248,9 +248,9 @@ regex=-407002: Embryonic limit for through connections exceeded (\d+)\/(\d+)\. (
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=407002; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1282383; \
id=208; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -285,9 +285,9 @@ regex=-106012: Deny IP from ([\d\.]+) to ([\d\.]+), IP options: "(.+)"; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=106012; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1279793; \
id=209; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -314,9 +314,9 @@ regex=-106021: Deny (\w+) reverse path check from ([\d\.]+) to ([\d\.]+) on inte
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=106021; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1279871; \
id=210; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -340,9 +340,9 @@ regex=-209003: Fragment database limit of (\d+) exceeded: src = ([\d\.]+), dest
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=209003; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1280434; \
id=211; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -367,9 +367,9 @@ regex=-500004: Invalid transport field for protocol=(\d+), from ([\d\.]+)\/(\d+)
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=500004; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1282628; \
id=212; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -393,9 +393,9 @@ regex=-405001: Received ARP (request|response) collision from ([\d\.]+)\/([A-Fa-
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=405001; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1282234; \
id=213; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -420,9 +420,9 @@ regex=-710003: (TCP|UDP) access denied by ACL from ([\d\.]+)\/(\d+) to (\S+):([\
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=710003; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp2503389; \
id=214; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -448,7 +448,7 @@ regex=-305006: Dst IP is network/broadcast IP, translation creation failed for (
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=305006; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1280915; \
id=215; \
revision=4; \
analyzer(0).name=ASA; \
@@ -476,9 +476,9 @@ regex=-313003: Invalid destination for ICMP error message: ICMP source ([\d\.]+)
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=313003; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1281049; \
id=216; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -510,9 +510,9 @@ regex=-313003: Invalid destination for ICMP error message: ICMP source ([\d\.]+)
# classification.reference(0).origin=vendor-specific; \
# classification.reference(0).meaning=asa_id; \
# classification.reference(0).name=106023; \
-# classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+# classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1279897; \
# id=217; \
-# revision=4; \
+# revision=5; \
# analyzer(0).name=ASA; \
# analyzer(0).manufacturer=Cisco; \
# analyzer(0).class=Firewall; \
@@ -539,9 +539,9 @@ regex=-313003: Invalid destination for ICMP error message: ICMP source ([\d\.]+)
# classification.reference(0).origin=vendor-specific; \
# classification.reference(0).meaning=asa_id; \
# classification.reference(0).name=106006; \
-# classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+# classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1279756; \
# id=218; \
-# revision=4; \
+# revision=5; \
# analyzer(0).name=ASA; \
# analyzer(0).manufacturer=Cisco; \
# analyzer(0).class=Firewall; \
@@ -567,9 +567,9 @@ regex=-106007: Deny inbound UDP from ([\d\.]+)/(\d+) to ([\d\.]+)/(\d+) due to D
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=106007; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1279764; \
id=219; \
- revision=4; \
+ revision=5; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -593,9 +593,9 @@ regex=-106007: Deny inbound UDP from ([\d\.]+)/(\d+) to ([\d\.]+)/(\d+) due to D
# classification.reference(0).origin=vendor-specific; \
# classification.reference(0).meaning=asa_id; \
# classification.reference(0).name=106001; \
-# classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+# classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1279735; \
# id=220; \
-# revision=4; \
+# revision=5; \
# analyzer(0).name=ASA; \
# analyzer(0).manufacturer=Cisco; \
# analyzer(0).class=Firewall; \
@@ -623,9 +623,9 @@ regex=-106017: Deny IP due to Land Attack from ([\d\.]+) to ([\d\.]+); \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=106017; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1279850; \
id=221; \
- revision=2; \
+ revision=3; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -650,7 +650,7 @@ regex=-305006: regular translation creation failed for icmp src (\S+):(\S+) dst
classification.reference(1).name=3; \
classification.reference(1).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0ca.html; \
id=222; \
- revision=2; \
+ revision=3; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
@@ -680,9 +680,9 @@ regex=-313003: Invalid destination for ICMP error message: icmp src (\S+):([\d\.
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=asa_id; \
classification.reference(0).name=313003; \
- classification.reference(0).url=http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1281049; \
id=223; \
- revision=2; \
+ revision=3; \
analyzer(0).name=ASA; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=Firewall; \
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog