xml output from Linux audit plugin
Steve Grubb <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi, Here's some sample output from the realtime audit event prelude plugin. There should be some selinux avcs, a segfault, a bad login, and a good login. Feedback is welcome as to how to make this better. -Steve _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel
prelude.log
(text/x-log, 10.9 KB)
version:
heartbeat:
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 8303
path: /usr/bin/prelude-manager
create_time: 23/01/2008 13:45:56.367227 -05:00
heartbeat_interval: 600
additional_data(0):
type: string (0)
meaning: Analyzer status
data: starting
additional_data(1):
type: string (0)
meaning: Analyzer SHA1
data: 21d24c04133559658e953b8d4f4969ed05305ae4
version:
heartbeat:
messageid: 1201113962
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 8303
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3188026575230221
name: audisp-prelude
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: linux-audit
version: 1.6.6
class: Software Monitoring
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name:
pid: 8308
create_time: 23/01/2008 13:46:01.572147 -05:00
analyzer_time: 23/01/2008 13:46:01.572246 -05:00
heartbeat_interval: 600
additional_data(0):
type: string (0)
meaning: Analyzer status
data: starting
version:
alert:
messageid: 5496081258
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 8303
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3188026575230221
name: audisp-prelude
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: linux-audit
version: 1.6.6
class: Software Monitoring
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name:
pid: 8308
create_time: 23/01/2008 13:46:01.572648 -05:00
classification:
text: MAC Violation
detect_time: 23/01/2008 12:43:41.0 -05:00
analyzer_time: 23/01/2008 13:46:01.573345 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: original-user (0)
tty: (none)
name: sgrubb
number: 4325
process:
name: "audisp-prelude"
pid: 7527
path: "/sbin/audisp-prelude"
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
file(0):
name:
path: /var/spool/prelude/audisp-prelude/global
category: (null) (0)
assessment:
impact:
severity: low (2)
completion: failed (1)
type: file (3)
version:
alert:
messageid: 18380983146
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 8303
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3188026575230221
name: audisp-prelude
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: linux-audit
version: 1.6.6
class: Software Monitoring
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name:
pid: 8308
create_time: 23/01/2008 13:46:01.573938 -05:00
classification:
text: App Abnormal Termination
detect_time: 23/01/2008 13:13:35.0 -05:00
analyzer_time: 23/01/2008 13:46:01.573969 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: original-user (0)
name: sgrubb
number: 4325
process:
name: "gpgsm"
pid: 7971
assessment:
impact:
severity: low (2)
completion: (null) (-1)
type: other (0)
version:
alert:
messageid: 9791048554
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 8303
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3188026575230221
name: audisp-prelude
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: linux-audit
version: 1.6.6
class: Software Monitoring
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name:
pid: 8308
create_time: 23/01/2008 13:46:01.573535 -05:00
classification:
text: Login
detect_time: 23/01/2008 12:55:00.0 -05:00
analyzer_time: 23/01/2008 13:46:01.573577 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
name: 127.0.0.1
user:
category: unknown (0)
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: original-user (0)
tty: sshd
name: sgrubb
process:
name:
pid: 7775
path: "/usr/sbin/sshd"
assessment:
impact:
severity: info (1)
completion: failed (1)
type: user (5)
version:
alert:
messageid: 14086015850
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 8303
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3188026575230221
name: audisp-prelude
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: linux-audit
version: 1.6.6
class: Software Monitoring
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name:
pid: 8308
create_time: 23/01/2008 13:46:01.573751 -05:00
classification:
text: Login
detect_time: 23/01/2008 12:55:02.0 -05:00
analyzer_time: 23/01/2008 13:46:01.573792 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: unknown (0)
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: original-user (0)
tty: /dev/pts/6
name: sgrubb
number: 4325
process:
name:
pid: 7775
path: "/usr/sbin/sshd"
assessment:
impact:
severity: info (1)
completion: succeeded (2)
type: user (5)
prelude-xml.log
(text/x-log, 9.6 KB)
<IDMEF-Message>
<Heartbeat>
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>8303</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
</Analyzer>
<CreateTime ntpstamp="0xcb4209e4.0x5e029000">2008-01-23T13:45:56.367227-05:00</CreateTime>
<AdditionalData type="string" meaning="Analyzer status">
<string>starting</string>
</AdditionalData>
<AdditionalData type="string" meaning="Analyzer SHA1">
<string>21d24c04133559658e953b8d4f4969ed05305ae4</string>
</AdditionalData>
</Heartbeat>
</IDMEF-Message>
<IDMEF-Message>
<Heartbeat messageid="1201113962">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>8303</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3188026575230221" name="audisp-prelude" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="linux-audit" version="1.6.6" class="Software Monitoring" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name></name>
<pid>8308</pid>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4209e9.0x92784000">2008-01-23T13:46:01.572147-05:00</CreateTime>
<AnalyzerTime ntpstamp="0xcb4209e9.0x927eb000">2008-01-23T13:46:01.572246-05:00</AnalyzerTime>
<AdditionalData type="string" meaning="Analyzer status">
<string>starting</string>
</AdditionalData>
</Heartbeat>
</IDMEF-Message>
<IDMEF-Message>
<Alert messageid="5496081258">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>8303</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3188026575230221" name="audisp-prelude" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="linux-audit" version="1.6.6" class="Software Monitoring" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name></name>
<pid>8308</pid>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4209e9.0x92991000">2008-01-23T13:46:01.572648-05:00</CreateTime>
<DetectTime ntpstamp="0xcb41fb4d.0x00000000">2008-01-23T12:43:41.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4209e9.0x92c6c000">2008-01-23T13:46:01.573345-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="original-user">
<name>sgrubb</name>
<number>4325</number>
</UserId>
</User>
<Process>
<name>"audisp-prelude"</name>
<pid>7527</pid>
<path>"/sbin/audisp-prelude"</path>
</Process>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application"/>
<File category="">
<name></name>
<path>/var/spool/prelude/audisp-prelude/global</path>
</File>
</Target>
<Classification text="MAC Violation"/>
<Assessment>
<Impact severity="low" completion="failed" type="file"/>
</Assessment>
</Alert>
</IDMEF-Message>
element User: validity error : Element User content does not follow the DTD, expecting (UserId)+, got
element File: validity error : Syntax of value for attribute category of File is not valid
element File: validity error : Value "" for attribute category of File is not among the enumerated set
<IDMEF-Message>
<Alert messageid="18380983146">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>8303</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3188026575230221" name="audisp-prelude" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="linux-audit" version="1.6.6" class="Software Monitoring" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name></name>
<pid>8308</pid>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4209e9.0x92eda000">2008-01-23T13:46:01.573938-05:00</CreateTime>
<DetectTime ntpstamp="0xcb42024f.0x00000000">2008-01-23T13:13:35.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4209e9.0x92efa000">2008-01-23T13:46:01.573969-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application"/>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="original-user">
<name>sgrubb</name>
<number>4325</number>
</UserId>
</User>
<Process>
<name>"gpgsm"</name>
<pid>7971</pid>
</Process>
</Target>
<Classification text="App Abnormal Termination"/>
<Assessment>
<Impact severity="low" completion="" type="other"/>
</Assessment>
</Alert>
</IDMEF-Message>
element User: validity error : Element User content does not follow the DTD, expecting (UserId)+, got
element Impact: validity error : Syntax of value for attribute completion of Impact is not valid
element Impact: validity error : Value "" for attribute completion of Impact is not among the enumerated set
<IDMEF-Message>
<Alert messageid="9791048554">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>8303</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3188026575230221" name="audisp-prelude" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="linux-audit" version="1.6.6" class="Software Monitoring" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name></name>
<pid>8308</pid>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4209e9.0x92d33000">2008-01-23T13:46:01.573535-05:00</CreateTime>
<DetectTime ntpstamp="0xcb41fdf4.0x00000000">2008-01-23T12:55:00.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4209e9.0x92d5f000">2008-01-23T13:46:01.573577-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<name>127.0.0.1</name>
</Node>
<User category="unknown"/>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="original-user">
<name>sgrubb</name>
</UserId>
</User>
<Process>
<name></name>
<pid>7775</pid>
<path>"/usr/sbin/sshd"</path>
</Process>
</Target>
<Classification text="Login"/>
<Assessment>
<Impact severity="info" completion="failed" type="user"/>
</Assessment>
</Alert>
</IDMEF-Message>
element User: validity error : Element User content does not follow the DTD, expecting (UserId)+, got
<IDMEF-Message>
<Alert messageid="14086015850">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>8303</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3188026575230221" name="audisp-prelude" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="linux-audit" version="1.6.6" class="Software Monitoring" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name></name>
<pid>8308</pid>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4209e9.0x92e16000">2008-01-23T13:46:01.573751-05:00</CreateTime>
<DetectTime ntpstamp="0xcb41fdf6.0x00000000">2008-01-23T12:55:02.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4209e9.0x92e41000">2008-01-23T13:46:01.573792-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="unknown"/>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="original-user">
<name>sgrubb</name>
<number>4325</number>
</UserId>
</User>
<Process>
<name></name>
<pid>7775</pid>
<path>"/usr/sbin/sshd"</path>
</Process>
</Target>
<Classification text="Login"/>
<Assessment>
<Impact severity="info" completion="succeeded" type="user"/>
</Assessment>
</Alert>
</IDMEF-Message>
element User: validity error : Element User content does not follow the DTD, expecting (UserId)+, got