[RFC patch prelude-lml] Add Deep Packet Inspection support for NetScreen v1

Hi,

Add Deep Packet Inspection alert support to prelude-lml ruleset for NetScreen.

Any comments are welcome. 

Thks

Index: b/ruleset/netscreen.rules
===================================================================
--- a/ruleset/netscreen.rules
+++ b/ruleset/netscreen.rules
@@ -65,3 +65,26 @@ regex=system-alert-\d+: (.+)! From ([\d\
  target(0).service.port=$5; \
  target(0).service.iana_protocol_name=$6; \
  last
+
+#LOG: Oct 29 11:29:16 hades-1 Hades-1: NetScreen device_id=Hades-1  [Root]system-critical-00601: SMB:ERROR:GRIND has been detected from 10.51.206.16/2637 to 10.8.101.25/445 through policy 243 1 times. (2008-10-29 12:29:17)
+regex=system-critical-\d+: (.+)! has been detected from ([\d\.]+)?/?(\d+) to ([\d\.]+)?/?(\d+) trough policy (\d+) (\d+) times. (([0-1]\d|2[0-3])-([0-5]\d)-([0-5]\d) ([0-1]\d|2[0-3]):([0-5]\d):([0-5]\d)); \
+ classification.text=$1; \
+ id=4402; \
+ revision=1; \
+ analyzer(0).name=Netscreen; \
+ analyzer(0).manufacturer=Juniper Networks; \
+ analyzer(0).class=Firewall; \
+ assessment.impact.severity=high; \
+ assessment.impact.completion=failed; \
+ assessment.impact.description=A $1 was seen $7 times coming from $2 ip trough policy $6.; \
+# source(0).interface=$8; \
+ source(0).node.address(0).category=ipv4-addr; \
+ source(0).node.address(0).address=$2; \
+ source(0).service.port=$3; \
+# source(0).service.iana_protocol_name=$6; \
+ target(0).node.address(0).category=ipv4-addr; \
+ target(0).node.address(0).address=$4; \
+ target(0).service.port=$5; \
+# target(0).service.iana_protocol_name=$6; \
+ last
+
Index: b/ruleset/pcre.rules
===================================================================
--- a/ruleset/pcre.rules
+++ b/ruleset/pcre.rules
@@ -91,7 +91,7 @@ regex=mssql;				include = ms-sql.rules;
 regex=nagios;				include = nagios.rules;
 regex=norton;				include = navce.rules;
 regex=\[[^:]*:[^\]]*\]:;		include = netapp-ontap.rules;
-regex=system-(emergency|alert)-;	include = netscreen.rules;
+regex=system-(emergency|alert|critical)-;	include = netscreen.rules;
 regex=security\[;			include = ntsyslog.rules;
 regex=[Pp][Aa][Mm]_;			include = pam.rules;
 regex=[Ss][Uu]:; 			include = su.rules; 


-- 
Jérôme Benoit aka fraggle
La Météo du Net - http://grenouille.com
OpenPGP Key ID : 9FE9161D
Key fingerprint : 9CA4 0249 AF57 A35B 34B3 AC15 FAA0 CB50 9FE9 161D

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkkLezQACgkQ+qDLUJ/pFh3bUACfTcs+uqtM2hp8T//bOdK+XB8S
PAQAoNepyZ502V4/UKEGWrdiQkAJjCWT
=46zK
-----END PGP SIGNATURE-----