Re: [Prelude Universal SIM system] #315: Using Named variables in PCRE ruleset

#315: Using Named variables in PCRE ruleset
-------------------------+--------------------------------------------------
 Reporter:  anonymous    |        Owner:                    
     Type:  enhancement  |       Status:  new               
 Priority:  normal       |    Milestone:  Prelude-LML 0.9.14
Component:  prelude-lml  |      Version:  0.9               
 Severity:  normal       |   Resolution:                    
 Keywords:  pcre         |  
-------------------------+--------------------------------------------------
Changes (by yoann):

  * milestone:  => Prelude-LML 0.9.14


Old description:

> Named Variables in pcre:
>
> This would make for quicker and simpler rules to be created in prelude-
> lml.
>
> Example from ntsyslog.rules:
>
> regex=security\[success\] 528 (.*) Successful Logon:  User
> Name:(?<username>[\w ]+)  Domain:(?<domain>.+)  Logon ID:\(?<lid>.*\)
> Logon Type:(?<ltype>\d+)  Logon Process:(?<lprocess>\w+) .* Workstation
> Name:(?<wks>\S+);
>         classification.text=Login; \
>
>         classification.reference(0).origin=vendor-specific; \
>
>         classification.reference(0).meaning=Windows Event ID; \
>
>         classification.reference(0).name=528; \
>
> classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com189.html;
> \
>
>         id=1401; \
>
>         revision=3; \
>
>         analyzer(0).name=NTsyslog; \
>
>         analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
>
>         analyzer(0).class=Logging; \
>
>         assessment.impact.severity=low; \
>
>         assessment.impact.completion=succeeded; \
>
>         assessment.impact.type=user; \
>
>         assessment.impact.description=$username successfully logged on on
> $wks ($domain domain) via $ltype; \
>
>         source(0).process.name=$5; \
>
>         source(0).node.address(0).category=unknown; \
>
>         source(0).node.address(0).address=$wks; \
>
>         source(0).node.name=$wks; \
>
>         source(0).user.category=os-device; \
>
>         source(0).user.user_id(0).type=current-user; \
>
>         source(0).user.user_id(0).name=$username; \
>
>         target(0).user.user_id(0).type=current-user; \
>
>         target(0).user.user_id(0).name=$username; \
>
>         additional_data(0).type=integer; \
>
>         additional_data(0).meaning=Logon type; \
>
>         additional_data(0).data=$ltype; \
>
>         additional_data(1).type=string; \
>
>         additional_data(1).meaning=Authentication domain; \
>
>         additional_data(1).data=$domain; \
>
>         last

New description:

 Named Variables in pcre:

 This would make for quicker and simpler rules to be created in prelude-
 lml.

 Example from ntsyslog.rules:

 {{{
 regex=security\[success\] 528 (.*) Successful Logon:  User
 Name:(?<username>[\w ]+)  Domain:(?<domain>.+)  Logon ID:\(?<lid>.*\)
 Logon Type:(?<ltype>\d+)  Logon Process:(?<lprocess>\w+) .* Workstation
 Name:(?<wks>\S+);
         classification.text=Login; \
         classification.reference(0).origin=vendor-specific; \
         classification.reference(0).meaning=Windows Event ID; \
         classification.reference(0).name=528; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com189.html;
 \
         id=1401; \
         revision=3; \
         analyzer(0).name=NTsyslog; \
         analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
         analyzer(0).class=Logging; \
         assessment.impact.severity=low; \
         assessment.impact.completion=succeeded; \
         assessment.impact.type=user; \
         assessment.impact.description=$username successfully logged on on
 $wks ($domain domain) via $ltype; \
         source(0).process.name=$5; \
         source(0).node.address(0).category=unknown; \
         source(0).node.address(0).address=$wks; \
         source(0).node.name=$wks; \
         source(0).user.category=os-device; \
         source(0).user.user_id(0).type=current-user; \
         source(0).user.user_id(0).name=$username; \
         target(0).user.user_id(0).type=current-user; \
         target(0).user.user_id(0).name=$username; \
         additional_data(0).type=integer; \
         additional_data(0).meaning=Logon type; \
         additional_data(0).data=$ltype; \
         additional_data(1).type=string; \
         additional_data(1).meaning=Authentication domain; \
         additional_data(1).data=$domain; \
         last
 }}}

--

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/315#comment:2>
Prelude Universal SIM system <http://www.prelude-ids.com>
Prelude Universal SIM system
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel