Prelude Events for PADS

Steve Grubb <[email protected]> Thu, 24 Jul 2008 10:29:27 -0400

Newsgroups	gmane.comp.security.ids.prelude.devel
Message-ID	<[email protected]>

Hi,

I've been working on adding support to pads for realtime events. pads is an 
acronym meaning Passive Asset Detection System. What it does is opens a 
promiscuous socket and listen to network activity. (To be useful in an actual 
deployment, you'd want it hanging off the monitor port of a switch or on a 
hub.) When it sees information related to the network its watching, it checks 
its database to see if it knows the IP address and service being connected 
to. It also watches the mappings of MAC address to IP address.

I've added a new plugin that you enable in /etc/pads.conf for prelude support. 
And I added an option to the csv plugin to make the database readonly. This 
way you can run the pads program for a week or so and create a baseline of 
addresses, services, and MAC addresses. Then you make it readonly. When 
anything new shows up on the network and gets used, pads will see it and 
generate a prelude event. The readonly option tells it to not add this asset 
to the csv database since its not part of your baseline. This should be 
useful in noticing when someone plugs in new equipment to the network or 
starts up a service that previously didn't exist.

You can get my test srpm from here:

http://people.redhat.com/sgrubb/files/pads-1.2-16.fc9.src.rpm

When you register it, it only needs idmef:w permissions.

Attached are the XML & debug for an ICMP event and a heartbeat.

-Steve

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel

prelude.log (text/x-log, 3.6 KB)

version: <empty>
heartbeat:
        messageid: dc4530be-58fd-11dd-a4c6
        analyzer(0): 
                analyzerid: 3752076040279179
                name: prelude-manager
                manufacturer: http://www.prelude-ids.com
                model: Prelude Manager
                version: 0.9.14
                class: Concentrator
                ostype: Linux
                osversion: 2.6.26-0.17.rc3.sg3.fc9.x86_64
                process:
                        name: prelude-manager
                        pid: 4857
                        path: /usr/bin/prelude-manager
        analyzer(1): 
                analyzerid: 3221651889063351
                name: pads
                manufacturer: http://passive.sourceforge.net
                model: pads
                version: 1.2
                class: PVS
                ostype: Linux
                osversion: 2.6.26-0.17.rc3.sg3.fc9.x86_64
                process:
                        name: pads
                        pid: 2832
                        path: /usr/bin/pads
        create_time: 23/07/2008 17:25:23.647498 -04:00
        analyzer_time: 24/07/2008 09:59:54.186413 -04:00
        heartbeat_interval: 600
        additional_data(0): 
                type: string (0)
                meaning: Analyzer status
                data: exiting
        additional_data(1): 
                type: string (0)
                meaning: Analyzer SHA1
                data: 5cca36e9ecd141eaebfb35b864635c9408992e40
version: <empty>
alert:
        messageid: ce349876-5988-11dd-857f
        analyzer(0): 
                analyzerid: 3752076040279179
                name: prelude-manager
                manufacturer: http://www.prelude-ids.com
                model: Prelude Manager
                version: 0.9.14
                class: Concentrator
                ostype: Linux
                osversion: 2.6.26-0.17.rc3.sg3.fc9.x86_64
                process:
                        name: prelude-manager
                        pid: 4857
                        path: /usr/bin/prelude-manager
        analyzer(1): 
                analyzerid: 3221651889063351
                name: pads
                manufacturer: http://passive.sourceforge.net
                model: pads
                version: 1.2
                class: PVS
                ostype: Linux
                osversion: 2.6.26-0.17.rc3.sg3.fc9.x86_64
                process:
                        name: pads
                        pid: 4875
                        path: /usr/bin/pads
        create_time: 24/07/2008 10:00:00.96018 -04:00
        classification:
                text: New Network Asset Detected
        detect_time: 24/07/2008 10:00:00.96018 -04:00
        analyzer_time: 24/07/2008 10:00:00.96117 -04:00
        source(0): 
                spoofed: unknown (0)
                node:
                        category: unknown (0)
                        address(0): 
                                category: ipv4-addr (7)
                                address: 192.168.3.5
                service:
                        ip_version: 4
                        iana_protocol_number: 1
                        iana_protocol_name: icmp
                        name: ICMP
                        port: 0
        target(0): 
                decoy: unknown (0)
        assessment:
                impact:
                        severity: low (2)
                        completion: succeeded (2)
                        type: other (0)
                        description: A service that was not previously known has been used.
        additional_data(0): 
                type: string (0)
                meaning: Application
                data: ICMP

prelude-xml.log (text/x-log, 3 KB)

<IDMEF-Message>
  <Heartbeat messageid="dc4530be-58fd-11dd-a4c6">
    <Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.14" class="Concentrator" ostype="Linux" osversion="2.6.26-0.17.rc3.sg3.fc9.x86_64">
      <Process>
        <name>prelude-manager</name>
        <pid>4857</pid>
        <path>/usr/bin/prelude-manager</path>
      </Process>
      <Analyzer analyzerid="3221651889063351" name="pads" manufacturer="http://passive.sourceforge.net" model="pads" version="1.2" class="PVS" ostype="Linux" osversion="2.6.26-0.17.rc3.sg3.fc9.x86_64">
        <Process>
          <name>pads</name>
          <pid>2832</pid>
          <path>/usr/bin/pads</path>
        </Process>
      </Analyzer>
    </Analyzer>
    <CreateTime ntpstamp="0xcc322043.0xa5c27000">2008-07-23T17:25:23.647498-04:00</CreateTime>
    <AnalyzerTime ntpstamp="0xcc33095a.0x2fb8c000">2008-07-24T09:59:54.186413-04:00</AnalyzerTime>
    <AdditionalData type="string" meaning="Analyzer status">
      <string>exiting</string>
    </AdditionalData>
    <AdditionalData type="string" meaning="Analyzer SHA1">
      <string>5cca36e9ecd141eaebfb35b864635c9408992e40</string>
    </AdditionalData>
  </Heartbeat>
</IDMEF-Message>


<IDMEF-Message>
  <Alert messageid="ce349876-5988-11dd-857f">
    <Analyzer analyzerid="3752076040279179" name="prelude-manager" manufacturer="http://www.prelude-ids.com" model="Prelude Manager" version="0.9.14" class="Concentrator" ostype="Linux" osversion="2.6.26-0.17.rc3.sg3.fc9.x86_64">
      <Process>
        <name>prelude-manager</name>
        <pid>4857</pid>
        <path>/usr/bin/prelude-manager</path>
      </Process>
      <Analyzer analyzerid="3221651889063351" name="pads" manufacturer="http://passive.sourceforge.net" model="pads" version="1.2" class="PVS" ostype="Linux" osversion="2.6.26-0.17.rc3.sg3.fc9.x86_64">
        <Process>
          <name>pads</name>
          <pid>4875</pid>
          <path>/usr/bin/pads</path>
        </Process>
      </Analyzer>
    </Analyzer>
    <CreateTime ntpstamp="0xcc330960.0x1894a000">2008-07-24T10:00:00.96018-04:00</CreateTime>
    <DetectTime ntpstamp="0xcc330960.0x1894a000">2008-07-24T10:00:00.96018-04:00</DetectTime>
    <AnalyzerTime ntpstamp="0xcc330960.0x189b2000">2008-07-24T10:00:00.96117-04:00</AnalyzerTime>
    <Source spoofed="unknown">
      <Node category="unknown">
        <Address category="ipv4-addr">
          <address>192.168.3.5</address>
        </Address>
      </Node>
      <Service ip_version="4" iana_protocol_number="1" iana_protocol_name="icmp">
        <name>ICMP</name>
        <port>0</port>
      </Service>
    </Source>
    <Target decoy="unknown"/>
    <Classification text="New Network Asset Detected"/>
    <Assessment>
      <Impact severity="low" completion="succeeded" type="other">A service that was not previously known has been used.</Impact>
    </Assessment>
    <AdditionalData type="string" meaning="Application">
      <string>ICMP</string>
    </AdditionalData>
  </Alert>
</IDMEF-Message>