Re: [Prelude Hybrid IDS] #185: defective squid rule in prelude-lml

#185: defective squid rule in prelude-lml
---------------------------------+------------------------------------------
 Reporter:  [email protected]  |        Owner:  yoann            
     Type:  defect               |       Status:  assigned         
 Priority:  normal               |    Milestone:  Prelude-LML 0.9.8
Component:  prelude-lml          |      Version:  0.9              
 Severity:  blocker              |   Resolution:                   
 Keywords:  squid                |  
---------------------------------+------------------------------------------
Changes (by yoann):

  * status:  new => assigned

Old description:

> I found a defective rule in the squid.rules file
> it has an error plus a missleading classification text and impact
> description
> here is a sample of the log
>
> [11323]: Squid Parent: child process 10216 exited due to signal 6
>
> here is what the rule currently is
>
> # No log sample; please submit
> regex=Squid Parent: child process (\d+) exited; \
>  classification.text=Proxy stopped; \
>  id=1808; \
>  revision=1; \
>  analyzer(0).name=Squid; \
>  analyzer(0).manufacturer=www.squid-cache.org; \
>  analyzer(0).class=Proxy; \
>  assessment.impact.severity=medium; \
>  assessment.impact.type=other; \
>  assessment.impact.description=Squid (pid $2) exited; \
>  target(0).node.name=$1; \
>  target(0).process.name=squid; \
>  target(0).process.pid=$2; \
>  last
>

> here is what it should be
>

>
> #[11323]: Squid Parent: child process 10216 exited due to signal 6
> regex=Squid Parent: child process (\d+) exited due to signal (\d); \
>  classification.text=Proxy child process stopped; \
>  id=1808; \
>  revision=2; \
>  analyzer(0).name=Squid; \
>  analyzer(0).manufacturer=www.squid-cache.org; \
>  analyzer(0).class=Proxy; \
>  assessment.impact.severity=low; \
>  assessment.impact.type=info; \
>  assessment.impact.description=A Squid child process (pid $1) exited
> after reciving a signal $2; \
>  target(0).process.name=squid; \
>  target(0).process.pid=$1; \
>  last

New description:

 I found a defective rule in the squid.rules file
 it has an error plus a missleading classification text and impact
 description
 here is a sample of the log

 {{{
 [11323]: Squid Parent: child process 10216 exited due to signal 6
 }}}

 here is what the rule currently is:

 {{{
 # No log sample; please submit
 regex=Squid Parent: child process (\d+) exited; \
  classification.text=Proxy stopped; \
  id=1808; \
  revision=1; \
  analyzer(0).name=Squid; \
  analyzer(0).manufacturer=www.squid-cache.org; \
  analyzer(0).class=Proxy; \
  assessment.impact.severity=medium; \
  assessment.impact.type=other; \
  assessment.impact.description=Squid (pid $2) exited; \
  target(0).node.name=$1; \
  target(0).process.name=squid; \
  target(0).process.pid=$2; \
  last
 }}}

 here is what it should be:


 {{{
 #[11323]: Squid Parent: child process 10216 exited due to signal 6
 regex=Squid Parent: child process (\d+) exited due to signal (\d); \
  classification.text=Proxy child process stopped; \
  id=1808; \
  revision=2; \
  analyzer(0).name=Squid; \
  analyzer(0).manufacturer=www.squid-cache.org; \
  analyzer(0).class=Proxy; \
  assessment.impact.severity=low; \
  assessment.impact.type=info; \
  assessment.impact.description=A Squid child process (pid $1) exited after
 reciving a signal $2; \
  target(0).process.name=squid; \
  target(0).process.pid=$1; \
  last
 }}}

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/185#comment:1>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel