[Prelude Hybrid IDS] #185: defective squid rule in prelude-lml

#185: defective squid rule in prelude-lml
---------------------------------+------------------------------------------
 Reporter:  [email protected]  |       Owner:  yoann            
     Type:  defect               |      Status:  new              
 Priority:  normal               |   Milestone:  Prelude-LML 0.9.8
Component:  prelude-lml          |     Version:  0.9              
 Severity:  blocker              |    Keywords:  squid            
---------------------------------+------------------------------------------
 I found a defective rule in the squid.rules file
 it has an error plus a missleading classification text and impact
 description
 here is a sample of the log

 [11323]: Squid Parent: child process 10216 exited due to signal 6

 here is what the rule currently is

 # No log sample; please submit
 regex=Squid Parent: child process (\d+) exited; \
  classification.text=Proxy stopped; \
  id=1808; \
  revision=1; \
  analyzer(0).name=Squid; \
  analyzer(0).manufacturer=www.squid-cache.org; \
  analyzer(0).class=Proxy; \
  assessment.impact.severity=medium; \
  assessment.impact.type=other; \
  assessment.impact.description=Squid (pid $2) exited; \
  target(0).node.name=$1; \
  target(0).process.name=squid; \
  target(0).process.pid=$2; \
  last


 here is what it should be



 #[11323]: Squid Parent: child process 10216 exited due to signal 6
 regex=Squid Parent: child process (\d+) exited due to signal (\d); \
  classification.text=Proxy child process stopped; \
  id=1808; \
  revision=2; \
  analyzer(0).name=Squid; \
  analyzer(0).manufacturer=www.squid-cache.org; \
  analyzer(0).class=Proxy; \
  assessment.impact.severity=low; \
  assessment.impact.type=info; \
  assessment.impact.description=A Squid child process (pid $1) exited after
 reciving a signal $2; \
  target(0).process.name=squid; \
  target(0).process.pid=$1; \
  last

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/185>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel