[Prelude Universal SIM system] #331: RULE CISCO-ROUTER UNRECOGNIZED

#331: RULE CISCO-ROUTER UNRECOGNIZED
-----------------------------------+----------------------------------------
 Reporter:  [email protected]  |        Type:  defect     
   Status:  new                    |    Priority:  high       
Milestone:  Prelude-LML 0.9.15     |   Component:  prelude-lml
  Version:  0.9                    |    Severity:  normal     
 Keywords:                         |  
-----------------------------------+----------------------------------------
 The following rule is not recognized:


 The log is the following:

 Nov  3 08:36:08 10.129.192.205 81: Nov  3 08:42:45 Caracas:
 %SEC-6-IPACCESSLOGDP: list prueba_access_in denied icmp 10.10.10.1 ->
 10.12.14.3 (3/1), 3 packets

 My regex is the following:

 regex=%SEC-6-IPACCESSLOGDP: list (\w+) denied (icmp)
 ([\d\.]+)\s+\-\>\s+([\d\.]+)\s+\(([\d\/]+)\), (\d+); \
  classification.text=Packet denied; \
  classification.reference(0).origin=vendor-specific; \
  classification.reference(0).meaning=cisco_id; \
  classification.reference(0).name=%SEC-6-IPACCESSLOGDP; \
 classification.reference(0).url=http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_system_message_guide_chapte$
  id=505; \
  revision=2; \
  analyzer(0).name=Router; \
  analyzer(0).manufacturer=Cisco; \
  analyzer(0).class=Router; \
  assessment.impact.completion=failed; \
  assessment.impact.type=other; \
  assessment.impact.severity=medium; \
  assessment.impact.description=Someone tried to bypass access-list #$1; \
  source(0).node.address(0).category=ipv4-addr; \
  source(0).node.address(0).address=$3; \
  source(0).service.port=$4; \
  source(0).service.iana_protocol_name=$2; \
  target(0).node.address(0).category=ipv4-addr; \
  target(0).node.address(0).address=$4; \
  target(0).service.port=$6; \
 last

 Can you help me? because the regex is matched with the Log..

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/331>
Prelude Universal SIM system <http://www.prelude-ids.com>
Prelude Universal SIM system
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel