xml output from Linux audit plugin v2
Steve Grubb <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi, I updated the Linux audit plugin based on feedback from this mail list. I think its looking a lot better. I know there are still a couple issues left to decide, but I thought I'd show these new samples of the debug log and the xml log to see what everyone thinks. Any feedback or suggestions would be welcome. Thanks, -Steve _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel
prelude-xml.log
(text/x-log, 15 KB)
<IDMEF-Message>
<Heartbeat>
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>28418</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
</Analyzer>
<CreateTime ntpstamp="0xcb4cbeb9.0xb4388000">2008-01-31T16:40:09.703987-05:00</CreateTime>
<AdditionalData type="string" meaning="Analyzer status">
<string>starting</string>
</AdditionalData>
<AdditionalData type="string" meaning="Analyzer SHA1">
<string>21d24c04133559658e953b8d4f4969ed05305ae4</string>
</AdditionalData>
</Heartbeat>
</IDMEF-Message>
<IDMEF-Message>
<Heartbeat messageid="1201815612">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>28418</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3131045245316742" name="auditd" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="auditd" version="1.6.7" class="HIDS" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>lt-audisp-prelude</name>
<pid>28423</pid>
<path>/home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude</path>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4cbebc.0x17ea0000">2008-01-31T16:40:12.93414-05:00</CreateTime>
<AnalyzerTime ntpstamp="0xcb4cbebc.0x17f1c000">2008-01-31T16:40:12.93533-05:00</AnalyzerTime>
<AdditionalData type="string" meaning="Analyzer status">
<string>starting</string>
</AdditionalData>
<AdditionalData type="string" meaning="Analyzer SHA1">
<string>26a6657407b7143eb9bcfe5f3223c156da1c4552</string>
</AdditionalData>
</Heartbeat>
</IDMEF-Message>
<IDMEF-Message>
<Alert messageid="5496782908">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>28418</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3131045245316742" name="auditd" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="auditd" version="1.6.7" class="HIDS" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>lt-audisp-prelude</name>
<pid>28423</pid>
<path>/home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude</path>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4cbebc.0x180c4000">2008-01-31T16:40:12.93937-05:00</CreateTime>
<DetectTime ntpstamp="0xcb41fb4d.0x00000000">2008-01-23T12:43:41.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4cbebc.0x183b5000">2008-01-31T16:40:12.94655-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="original-user">
<name>sgrubb</name>
<number>4325</number>
</UserId>
</User>
<Process>
<name>audisp-prelude</name>
<pid>7527</pid>
<path>/sbin/audisp-prelude</path>
</Process>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<File category="current">
<name>global</name>
<path>/var/spool/prelude/audisp-prelude/global</path>
</File>
</Target>
<Classification text="MAC Violation"/>
<Assessment>
<Impact severity="low" completion="failed" type="file">A program has tried to access something that is not allowed in the MAC policy. This could indicate an attacker trying to exploit a weakness in the program.</Impact>
</Assessment>
<AdditionalData type="string" meaning="AVC Text">
<string>type=AVC msg=audit(1201110221.825:358): avc: denied { search } for pid=7527 comm="audisp-prelude" name="spool" dev=sda8 ino=8290346 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir</string>
</AdditionalData>
</Alert>
</IDMEF-Message>
<IDMEF-Message>
<Alert messageid="18381684796">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>28418</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3131045245316742" name="auditd" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="auditd" version="1.6.7" class="HIDS" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>lt-audisp-prelude</name>
<pid>28423</pid>
<path>/home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude</path>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4cbebc.0x1866a000">2008-01-31T16:40:12.95316-05:00</CreateTime>
<DetectTime ntpstamp="0xcb42024f.0x00000000">2008-01-23T13:13:35.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4cbebc.0x186b0000">2008-01-31T16:40:12.95383-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application"/>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="original-user">
<name>sgrubb</name>
<number>4325</number>
</UserId>
</User>
<Process>
<name>gpgsm</name>
<pid>7971</pid>
</Process>
</Target>
<Classification text="App Abnormal Termination"/>
<Assessment>
<Impact severity="low" completion="" type="other">An application terminated abnormally. An attacker may be trying to exploit a weakness in the program.</Impact>
</Assessment>
<AdditionalData type="string" meaning="Signal">
<string>Segmentation fault</string>
</AdditionalData>
</Alert>
</IDMEF-Message>
element User: validity error : Element User content does not follow the DTD, expecting (UserId)+, got
element Impact: validity error : Syntax of value for attribute completion of Impact is not valid
element Impact: validity error : Value "" for attribute completion of Impact is not among the enumerated set
<IDMEF-Message>
<Alert messageid="9791750204">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>28418</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3131045245316742" name="auditd" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="auditd" version="1.6.7" class="HIDS" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>lt-audisp-prelude</name>
<pid>28423</pid>
<path>/home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude</path>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4cbebc.0x184cc000">2008-01-31T16:40:12.94921-05:00</CreateTime>
<DetectTime ntpstamp="0xcb41fdf4.0x00000000">2008-01-23T12:55:00.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4cbebc.0x1850b000">2008-01-31T16:40:12.94981-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<Address category="ipv4-addr">
<address>127.0.0.1</address>
</Address>
</Node>
<User category="unknown"/>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="target-user">
<name>sgrubb</name>
</UserId>
</User>
<Process>
<name>sshd</name>
<pid>7775</pid>
<path>/usr/sbin/sshd</path>
</Process>
</Target>
<Classification text="Login"/>
<Assessment>
<Impact severity="info" completion="failed" type="user">A user has attempted to login</Impact>
</Assessment>
</Alert>
</IDMEF-Message>
element User: validity error : Element User content does not follow the DTD, expecting (UserId)+, got
<IDMEF-Message>
<Alert messageid="14086717500">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>28418</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3131045245316742" name="auditd" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="auditd" version="1.6.7" class="HIDS" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>lt-audisp-prelude</name>
<pid>28423</pid>
<path>/home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude</path>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4cbebc.0x18592000">2008-01-31T16:40:12.95110-05:00</CreateTime>
<DetectTime ntpstamp="0xcb41fdf6.0x00000000">2008-01-23T12:55:02.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4cbebc.0x185c3000">2008-01-31T16:40:12.95157-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="unknown"/>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="target-user">
<name>sgrubb</name>
<number>4325</number>
</UserId>
</User>
<Process>
<name>sshd</name>
<pid>7775</pid>
<path>/usr/sbin/sshd</path>
</Process>
</Target>
<Classification text="Login"/>
<Assessment>
<Impact severity="info" completion="succeeded" type="user">A user has attempted to login</Impact>
</Assessment>
</Alert>
</IDMEF-Message>
element User: validity error : Element User content does not follow the DTD, expecting (UserId)+, got
<IDMEF-Message>
<Alert messageid="22676652092">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>28418</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3131045245316742" name="auditd" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="auditd" version="1.6.7" class="HIDS" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>lt-audisp-prelude</name>
<pid>28423</pid>
<path>/home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude</path>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4cbebc.0x18783000">2008-01-31T16:40:12.95584-05:00</CreateTime>
<DetectTime ntpstamp="0xcb4c697f.0x00000000">2008-01-31T10:36:31.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4cbebc.0x187dc000">2008-01-31T16:40:12.95669-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="original-user">
<name>sgrubb</name>
<number>4325</number>
</UserId>
</User>
<Process>
<name>setenforce</name>
<pid>26676</pid>
<path>/usr/sbin/setenforce</path>
</Process>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="os-device"/>
</Target>
<Classification text="SE Linux Enforcement Disabled"/>
<Assessment>
<Impact severity="high" completion="succeeded" type="other">A program has changed SE Linux policy enforcement. If this is not expected, it could be an attempt to subvert the system.</Impact>
</Assessment>
</Alert>
</IDMEF-Message>
element User: validity error : Element User content does not follow the DTD, expecting (UserId)+, got
<IDMEF-Message>
<Alert messageid="26971619388">
<Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.10" class="Concentrator" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>prelude-manager</name>
<pid>28418</pid>
<path>/usr/bin/prelude-manager</path>
</Process>
<Analyzer analyzerid="3131045245316742" name="auditd" manufacturer="Red Hat, http://people.redhat.com/sgrubb/audit/" model="auditd" version="1.6.7" class="HIDS" ostype="Linux" osversion="2.6.23.8-63.fc8">
<Process>
<name>lt-audisp-prelude</name>
<pid>28423</pid>
<path>/home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude</path>
</Process>
</Analyzer>
</Analyzer>
<CreateTime ntpstamp="0xcb4cbebc.0x188a9000">2008-01-31T16:40:12.95864-05:00</CreateTime>
<DetectTime ntpstamp="0xcb4c79f0.0x00000000">2008-01-31T11:46:40.00-05:00</DetectTime>
<AnalyzerTime ntpstamp="0xcb4cbebc.0x188ed000">2008-01-31T16:40:12.95929-05:00</AnalyzerTime>
<Source spoofed="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="application">
<UserId type="original-user">
<name>sgrubb</name>
<number>4325</number>
</UserId>
</User>
<Process>
<name>tcpdump</name>
<pid>27831</pid>
<path>/usr/sbin/tcpdump</path>
</Process>
</Source>
<Target decoy="unknown">
<Node category="hosts">
<name>centaur</name>
</Node>
<User category="os-device"/>
</Target>
<Classification text="Promiscuous Socket Closed"/>
<Assessment>
<Impact severity="info" completion="succeeded" type="recon">A program has opened or closed a promiscuous socket. If this is not expected, it could be an attacker trying to sniff traffic.</Impact>
</Assessment>
</Alert>
</IDMEF-Message>
element User: validity error : Element User content does not follow the DTD, expecting (UserId)+, got
prelude.log
(text/x-log, 17.5 KB)
version:
heartbeat:
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 28418
path: /usr/bin/prelude-manager
create_time: 31/01/2008 16:40:09.703987 -05:00
heartbeat_interval: 600
additional_data(0):
type: string (0)
meaning: Analyzer status
data: starting
additional_data(1):
type: string (0)
meaning: Analyzer SHA1
data: 21d24c04133559658e953b8d4f4969ed05305ae4
version:
heartbeat:
messageid: 1201815612
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 28418
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3131045245316742
name: auditd
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: auditd
version: 1.6.7
class: HIDS
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: lt-audisp-prelude
pid: 28423
path: /home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude
create_time: 31/01/2008 16:40:12.93414 -05:00
analyzer_time: 31/01/2008 16:40:12.93533 -05:00
heartbeat_interval: 600
additional_data(0):
type: string (0)
meaning: Analyzer status
data: starting
additional_data(1):
type: string (0)
meaning: Analyzer SHA1
data: 26a6657407b7143eb9bcfe5f3223c156da1c4552
version:
alert:
messageid: 5496782908
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 28418
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3131045245316742
name: auditd
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: auditd
version: 1.6.7
class: HIDS
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: lt-audisp-prelude
pid: 28423
path: /home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude
create_time: 31/01/2008 16:40:12.93937 -05:00
classification:
text: MAC Violation
detect_time: 23/01/2008 12:43:41.0 -05:00
analyzer_time: 31/01/2008 16:40:12.94655 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: original-user (0)
tty: (none)
name: sgrubb
number: 4325
process:
name: audisp-prelude
pid: 7527
path: /sbin/audisp-prelude
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
file(0):
name: global
path: /var/spool/prelude/audisp-prelude/global
category: current (1)
assessment:
impact:
severity: low (2)
completion: failed (1)
type: file (3)
description: A program has tried to access something that is not allowed in the MAC policy. This could indicate an attacker trying to exploit a weakness in the program.
additional_data(0):
type: string (0)
meaning: AVC Text
data: type=AVC msg=audit(1201110221.825:358): avc: denied { search } for pid=7527 comm="audisp-prelude" name="spool" dev=sda8 ino=8290346 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir
version:
alert:
messageid: 18381684796
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 28418
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3131045245316742
name: auditd
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: auditd
version: 1.6.7
class: HIDS
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: lt-audisp-prelude
pid: 28423
path: /home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude
create_time: 31/01/2008 16:40:12.95316 -05:00
classification:
text: App Abnormal Termination
detect_time: 23/01/2008 13:13:35.0 -05:00
analyzer_time: 31/01/2008 16:40:12.95383 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: original-user (0)
name: sgrubb
number: 4325
process:
name: gpgsm
pid: 7971
assessment:
impact:
severity: low (2)
completion: (null) (-1)
type: other (0)
description: An application terminated abnormally. An attacker may be trying to exploit a weakness in the program.
additional_data(0):
type: string (0)
meaning: Signal
data: Segmentation fault
version:
alert:
messageid: 9791750204
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 28418
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3131045245316742
name: auditd
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: auditd
version: 1.6.7
class: HIDS
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: lt-audisp-prelude
pid: 28423
path: /home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude
create_time: 31/01/2008 16:40:12.94921 -05:00
classification:
text: Login
detect_time: 23/01/2008 12:55:00.0 -05:00
analyzer_time: 31/01/2008 16:40:12.94981 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
address(0):
category: ipv4-addr (7)
address: 127.0.0.1
user:
category: unknown (0)
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: target-user (2)
tty: sshd
name: sgrubb
process:
name: sshd
pid: 7775
path: /usr/sbin/sshd
assessment:
impact:
severity: info (1)
completion: failed (1)
type: user (5)
description: A user has attempted to login
version:
alert:
messageid: 14086717500
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 28418
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3131045245316742
name: auditd
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: auditd
version: 1.6.7
class: HIDS
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: lt-audisp-prelude
pid: 28423
path: /home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude
create_time: 31/01/2008 16:40:12.95110 -05:00
classification:
text: Login
detect_time: 23/01/2008 12:55:02.0 -05:00
analyzer_time: 31/01/2008 16:40:12.95157 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: unknown (0)
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: target-user (2)
tty: /dev/pts/6
name: sgrubb
number: 4325
process:
name: sshd
pid: 7775
path: /usr/sbin/sshd
assessment:
impact:
severity: info (1)
completion: succeeded (2)
type: user (5)
description: A user has attempted to login
version:
alert:
messageid: 22676652092
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 28418
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3131045245316742
name: auditd
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: auditd
version: 1.6.7
class: HIDS
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: lt-audisp-prelude
pid: 28423
path: /home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude
create_time: 31/01/2008 16:40:12.95584 -05:00
classification:
text: SE Linux Enforcement Disabled
detect_time: 31/01/2008 10:36:31.0 -05:00
analyzer_time: 31/01/2008 16:40:12.95669 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: original-user (0)
tty: pts1
name: sgrubb
number: 4325
process:
name: setenforce
pid: 26676
path: /usr/sbin/setenforce
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: os-device (2)
assessment:
impact:
severity: high (4)
completion: succeeded (2)
type: other (0)
description: A program has changed SE Linux policy enforcement. If this is not expected, it could be an attempt to subvert the system.
version:
alert:
messageid: 26971619388
analyzer(0):
analyzerid: 3752076040279179
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: prelude-manager
pid: 28418
path: /usr/bin/prelude-manager
analyzer(1):
analyzerid: 3131045245316742
name: auditd
manufacturer: Red Hat, http://people.redhat.com/sgrubb/audit/
model: auditd
version: 1.6.7
class: HIDS
ostype: Linux
osversion: 2.6.23.8-63.fc8
process:
name: lt-audisp-prelude
pid: 28423
path: /home/sgrubb/working/BUILD/audit-1.6.7/audisp/plugins/prelude/.libs/lt-audisp-prelude
create_time: 31/01/2008 16:40:12.95864 -05:00
classification:
text: Promiscuous Socket Closed
detect_time: 31/01/2008 11:46:40.0 -05:00
analyzer_time: 31/01/2008 16:40:12.95929 -05:00
source(0):
spoofed: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: application (1)
user_id(0):
type: original-user (0)
tty: pts3
name: sgrubb
number: 4325
process:
name: tcpdump
pid: 27831
path: /usr/sbin/tcpdump
target(0):
decoy: unknown (0)
node:
category: hosts (6)
name: centaur
user:
category: os-device (2)
assessment:
impact:
severity: info (1)
completion: succeeded (2)
type: recon (4)
description: A program has opened or closed a promiscuous socket. If this is not expected, it could be an attacker trying to sniff traffic.