Re: xml output from Linux audit plugin

Hi Steve,

Thanks for providing us with the alert dump, some quick comments inline:


Le mercredi 23 janvier 2008 à 13:50 -0500, Steve Grubb a écrit :
> version: 
> heartbeat:
>         analyzer(0): 
>                 analyzerid: 3752076040279179
>                 name: prelude-manager
>                 manufacturer: http://www.prelude-ids.com
>                 model: Prelude Manager
>                 version: 0.9.10
>                 class: Concentrator
>                 ostype: Linux
>                 osversion: 2.6.23.8-63.fc8
>                 process:
>                         name: prelude-manager
>                         pid: 8303
>                         path: /usr/bin/prelude-manager

In the first heartbeat emitted, the auditd analyzer entry is missing. I
guess the analyzer object was not associated early enough (before
calling prelude_client_start).


[here's the second heartbeat, this time with the auditd analyzer]

>         analyzer(1): 
>                 analyzerid: 3188026575230221
>                 name: audisp-prelude

Usually, we use the sensor name as the default analyzer name, so here
I'd simply use "auditd".


>                 model: linux-audit

Should be the same as analyzer name (this one is static, while the user
might choose to change analyzer->name through manual configuration).
Additionally, you might want to use an uppercase here: "Auditd".

>                 class: Software Monitoring

Use HIDS as the class for now (we are currently reworking analyzer Class
to achieve bette normalization, but let's stick to the default for now).

>                 process:
>                         name: 
>                         pid: 8308

The process name is missing, how is prelude_init() called? Would it be
possible that you provide the argc / argv argument to the initialization
function?


>         classification:
>                 text: MAC Violation
>         detect_time: 23/01/2008 12:43:41.0 -05:00
>         analyzer_time: 23/01/2008 13:46:01.573345 -05:00
>         source(0): 
>                 spoofed: unknown (0)
>                 node:
>                         category: hosts (6)
>                         name: centaur

Would it be possible that you work on a function to resolve the name,
and then use the result to populate node.address(*).address ?

Additionally, getting the FQDN for this host into node.name would be
nice.

>                 user:
>                         category: application (1)
>                         user_id(0): 
>                                 type: original-user (0)
>                                 tty: (none)

The "(none)" value look like invalid.


>         target(0): 
>                 decoy: unknown (0)
>                 node:
>                         category: hosts (6)
>                         name: centaur

Above comments concerning the source.node object apply.

>                 user:
>                         category: application (1)

No user object should be set within the message if there is not at least
one user_id associated with it.


>                 file(0): 
>                         name: 
>                         path: /var/spool/prelude/audisp-prelude/global
>                         category: (null) (0)

Name is missing and should be "global" here.
Category is required to be set, use either "original" or "current".


>         assessment:
>                 impact:
>                         severity: low (2)
>                         completion: (null) (-1)
>                         type: other (0)

An impact description, if you have access to one, would be nice!
Additionally, the '-1' value used for completion is invalid.



> version: 
> alert:

[...]

>         target(0): 
>                 decoy: unknown (0)
>                 node:
>                         category: hosts (6)
>                         name: centaur
>                 user:
>                         category: application (1)
>                         user_id(0): 
>                                 type: original-user (0)
>                                 tty: sshd
>                                 name: sgrubb


Shouldn't type be 'target-user'? 
Also, the tty value look like invalid compared to the alert that follow.

>                 process:
>                         name: 
>                         pid: 7775
>                         path: "/usr/sbin/sshd"

Missing process name, should be parsed to "sshd".



The following alert look like a duplicate, is it expected?

> version: 
> alert:
>         detect_time: 23/01/2008 12:55:02.0 -05:00
>       


Thanks again for your great work!

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel