prelude-lml/master: Add Cisco ASA rule to handle discarded tcp or udp packets.

commit 1700c398b16b5d0589ae993a2482dcb7e96401a6
Author: Sebastien Tricaud <toady@kirk.(none)>
Date:   Wed Jul 1 14:58:29 2009 +0200

    Add Cisco ASA rule to handle discarded tcp or udp packets.


========================================

 plugins/pcre/ruleset/cisco-asa.rules |   29 ++++++++++++++++++++++++++++-
 1 files changed, 28 insertions(+), 1 deletions(-)

========================================

diff --git a/plugins/pcre/ruleset/cisco-asa.rules b/plugins/pcre/ruleset/cisco-asa.rules
index b977420..5305ecf 100644
--- a/plugins/pcre/ruleset/cisco-asa.rules
+++ b/plugins/pcre/ruleset/cisco-asa.rules
@@ -708,6 +708,34 @@ regex=-313003: Invalid destination for ICMP error message: icmp src (\S+):([\d\.
  additional_data(1).data=$6; \
  last
 
+#LOG: 06-30-2009 17:25:09 Local0.Debug 172.19.1.1 Jun 30 2009 07:08:20: %ASA-7-710005: TCP request discarded from 172.19.1.6/1303 to inside:172.19.1.1/2601
+regex=-710005: (TCP|UDP) request discarded from ([\d\.]+)/(\d+) to (\S+):([\d\.]+)/(\d+)
+ classification.text=$1 request discarded; \
+ classification.reference(0).origin=vendor-specific; \
+ classification.reference(0).meaning=asa_id; \
+ classification.reference(0).name=710005; \
+ classification.reference(0).url=http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1285746; \
+ id=224; \
+ revision=1; \
+ analyzer(0).name=ASA; \
+ analyzer(0).manufacturer=Cisco; \
+ analyzer(0).class=Firewall; \
+ assessment.impact.severity=info; \
+ assessment.impact.completion=failed; \
+ assessment.impact.type=recon; \
+ assessment.impact.description=The appliance does not have a UDP server that services the UDP request. The message can also indicate a TCP packet that does not belong to any session on the security appliance. In addition, this message appears (with the snmp service) when the security appliance receives an SNMP request with an empty payload, even if it is from an authorized host. With the snmp service, this message occurs a maximum of 1 time every 10 seconds so that the log receiver is not overwhelmed.; \
+ source(0).node.address(0).category=ipv4-addr; \
+ source(0).node.address(0).address=$2; \
+ source(0).service.iana_protocol_name=$1; \
+ source(0).service.port=$3; \
+ target(0).node.address(0).category=ipv4-addr; \
+ target(0).node.address(0).address=$5; \
+ target(0).service.iana_protocol_name=$1; \
+ target(0).service.port=$6; \
+ target(0).interface=$4; \
+ last
+
+
 # Events taken from the Cisco System Log Messages List that will need rules
 # (include 'attack' || 'intrusion' || 'probe' || 'covert' in description; no log samples):
 # %PIX-1-106021: Deny protocol reverse path check from source_address to dest_address on interface interface_name
@@ -721,7 +749,6 @@ regex=-313003: Invalid destination for ICMP error message: icmp src (\S+):([\d\.
 # %PIX-4-402101: decaps: rec'd IPSEC packet has invalid spi for destaddr=dest_address, prot=protocol, spi=number
 # %PIX-4-402102: decapsulate: packet missing {AH|ESP}, destadr=dest_address, actual prot=protocol
 # %PIX-4-405002: Received mac mismatch collision from IP_address/mac_address for authenticated host
-# %PIX-7-710005: {TCP|UDP} request discarded from source_address/source_port to interface_name:dest_address/service
 # %PIX-7-710006: protocol request discarded from source_address to interface_name:dest_address
 # %PIX-2-106020: Deny IP teardrop fragment (size = number, offset = number) from IP_address to IP_address
 # %PIX-4-209004: Invalid IP fragment, size = bytes exceeds maximum size = bytes: src = IP_address, dest = IP_address, proto = protocol, id = number
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog