Snare Event Log rules for windows event 528 and 529

Hi There

I have a customer with a Prelude server running the Snare Agent for  
Windows
for sending Windows event log as syslog to the server, for analyzing  
with LML

Snare:
http://www.intersectalliance.com/projects/SnareWindows/

We used the ntsyslog rules as inspiration and have produced the  
following rules
which I would like feedback on, and you can include it in prelude if  
you wish.

It seems to work now, but I did have some problems due to the tabs used
in the format from Snare.



I hope the following paste doesn't break, if so - you can download  
from this
temporary location:
http://www.kramse.dk/files/tmp/snare-win.rules

snare-win.rules:
#####
#
# Copyright (C) 2007 Henrik Kramshoej
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING.  If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
#
#####

#############################################################################
#
# This ruleset aims at analyzing the logs returned by the Snare Agent  
for
# Windows, which converts NT events to syslog.
# English logs only.
# TODO:
# *  Add all log entries not currently present
#
#############################################################################

# failed login
regex=Security.+(529|534).+\sLogon Failure:     Reason: (.+)  User  
Name: (\w+)     Domain:(.+)Logon Type: (\d+)     Logon Process: (\w 
+)       Authentication Package:.+     Workstation Name: (\w+); \
  classification.text=Login failure; \
  classification.reference(0).origin=vendor-specific; \
  classification.reference(0).meaning=Windows Event ID; \
  classification.reference(0).name=$1; \
  id=6001; \
  revision=2; \
  analyzer(0).name=SNARE; \
  analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows/ 
; \
  analyzer(0).class=Logging; \
  source(0).process.name=$6; \
  target(0).node.address(0).category=unknown; \
  target(0).node.address(0).address=$7; \
  target(0).node.name=$7; \
  target(0).user.category=os-device; \
  target(0).user.user_id(0).type=target-user; \
  target(0).user.user_id(0).name=$3; \
  additional_data(0).type=integer; \
  additional_data(0).meaning=Logon type; \
  additional_data(0).data=$5; \
  additional_data(1).type=string; \
  additional_data(1).meaning=Authentication domain; \
  additional_data(1).data=$4; \
  last

# success login
regex=Security.+528(.+\s) User Name: (\w+)[\s]+Domain: (\w+)[\s]+Logon  
ID: \(.*\)[\s]+Logon Type: (\d+)[\s]+Logon Process: (\w+) .*  
Workstation Name: (\S+); \
  classification.text=Login successful; \
  classification.reference(0).origin=vendor-specific; \
  classification.reference(0).meaning=Windows Event ID; \
  classification.reference(0).name=528; \
  classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com189.html 
; \
  id=6002; \
  revision=2; \
  analyzer(0).name=SNARE; \
  analyzer(0).manufacturer=http://www.intersectalliance.com/projects/SnareWindows/ 
; \
  analyzer(0).class=Logging; \
  assessment.impact.severity=low; \
  assessment.impact.completion=succeeded; \
  assessment.impact.type=user; \
  assessment.impact.description=$2 successfully logged on on $6 ($3  
domain) via $5; \
  source(0).process.name=$5; \
  source(0).node.address(0).category=unknown; \
  source(0).node.address(0).address=$6; \
  source(0).node.name=$6; \
  source(0).user.category=os-device; \
  source(0).user.user_id(0).type=current-user; \
  source(0).user.user_id(0).name=$1; \
  target(0).user.user_id(0).type=current-user; \
  target(0).user.user_id(0).name=$2; \
  additional_data(0).type=integer; \
  additional_data(0).meaning=Logon type; \
  additional_data(0).data=$4; \
  additional_data(1).type=string; \
  additional_data(1).meaning=Authentication domain; \
  additional_data(1).data=$3; \
  last

The input I used for developing this can be found at temporary location:
http://www.kramse.dk/files/tmp/messages

Jan 14 09:11:48 10.11.12.13 MSWinEventLog	1	Security	1282	Mon Jan 14  
09:11:32 2008	528	Security	henrik	User	Success Audit	DC01	Logon/ 
Logoff		Successful Logon:     User Name: henrik     Domain:  
MYDOMAIN     Logon ID: (0x0,0x33C8A3B9)     Logon Type: 7     Logon  
Process: User32       Authentication Package: Negotiate      
Workstation Name: DC01     Logon GUID:  
{1234567-1234-1234-1234-878858067cf1}     Caller User Name: DC01$      
Caller Domain: MYDOMAIN     Caller Logon ID: (0x0,0x3E7)     Caller  
Process ID: 7784     Transited Services: -     Source Network Address:  
10.11.12.14     Source Port: 2618    	1267     Source Port: 3106    	 
7850
Jan 14 11:05:00 10.11.12.13 MSWinEventLog	1	Security	8053	Mon Jan 14  
11:04:57 2008	529	Security	SYSTEM	User	Failure Audit	DC01	Logon/ 
Logoff		Logon Failure:     Reason: Unknown user name or bad  
password     User Name: henrik     Domain:      Logon Type: 10      
Logon Process: User32       Authentication Package: Negotiate      
Workstation Name: DC01     Caller User Name: DC01$     Caller Domain:  
MYDOMAIN     Caller Logon ID: (0x0,0x3E7)     Caller Process ID:  
5132     Transited Services: -     Source Network Address:  
10.11.12.14     Source Port: 2029    	7916

Best regards

Henrik
--
Henrik Lund Kramshøj, Follower of the Great Way of Unix
[email protected], +45 2026 6000 cand.scient CISSP CEH
http://www.security6.net - IPv6, sikkerhed, netværk
http://e-learning.security6.net - gratis kursusmateriale


_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel