[Prelude Universal SIM system] #315: Using Named variables in PCRE ruleset

#315: Using Named variables in PCRE ruleset
-----------------------+----------------------------------------------------
 Reporter:  anonymous  |        Type:  enhancement
   Status:  new        |    Priority:  normal     
Milestone:             |   Component:  prelude-lml
  Version:  0.9        |    Severity:  normal     
 Keywords:  pcre       |  
-----------------------+----------------------------------------------------
 Named Variables in pcre:

 This would make for quicker and simpler rules to be created in prelude-
 lml.

 Example from ntsyslog.rules:

 regex=security\[success\] 528 (.*) Successful Logon:  User
 Name:(?<username>[\w ]+)  Domain:(?<domain>.+)  Logon ID:\(?<lid>.*\)
 Logon Type:(?<ltype>\d+)  Logon Process:(?<lprocess>\w+) .* Workstation
 Name:(?<wks>\S+);
         classification.text=Login; \

         classification.reference(0).origin=vendor-specific; \

         classification.reference(0).meaning=Windows Event ID; \

         classification.reference(0).name=528; \

 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com189.html;
 \

         id=1401; \

         revision=3; \

         analyzer(0).name=NTsyslog; \

         analyzer(0).manufacturer=ntsyslog.sourceforge.net; \

         analyzer(0).class=Logging; \

         assessment.impact.severity=low; \

         assessment.impact.completion=succeeded; \

         assessment.impact.type=user; \

         assessment.impact.description=$username successfully logged on on
 $wks ($domain domain) via $ltype; \

         source(0).process.name=$5; \

         source(0).node.address(0).category=unknown; \

         source(0).node.address(0).address=$wks; \

         source(0).node.name=$wks; \

         source(0).user.category=os-device; \

         source(0).user.user_id(0).type=current-user; \

         source(0).user.user_id(0).name=$username; \

         target(0).user.user_id(0).type=current-user; \

         target(0).user.user_id(0).name=$username; \

         additional_data(0).type=integer; \

         additional_data(0).meaning=Logon type; \

         additional_data(0).data=$ltype; \

         additional_data(1).type=string; \

         additional_data(1).meaning=Authentication domain; \

         additional_data(1).data=$domain; \

         last

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/315>
Prelude Universal SIM system <http://www.prelude-ids.com>
Prelude Universal SIM system
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel