Re: R: Question regarding regular expressions andprelude-lml

What does your syslog stream look like?  It sounds like the format
doesn't match the defined format for the file in prelude-lml.conf.

- Ramon

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of
[email protected]
Sent: Monday, June 29, 2009 8:53 AM
To: [email protected]
Subject: [prelude-user] R: Question regarding regular expressions
andprelude-lml

All, 

I have been working on creating [ regex= ] rules for the windows snare 
agent within prelude-lml and I am experiencing a very peculiar issue
where 
some messages are just not being matched, even if I change the regex to 
something global like 

regex=.+

I get tons of messages with the following

no appropriate format defined for log entry;

I am wondering if control characters mess up the regex parsing ??  Are 
there limitations in the use of the PCRE regex engine? 

Summary of steps to get a regex:

1. I am creating the initial regex in a perl script for each line I
would 
like to match within an LML rule. Upon successful testing within the
perl 
script I copy that regex to an LML rule file 

next if (/.+Security.+(538)\s+Security\s+(\w+|\w+\$|\w+\-\w+\$|ANONYMOUS

LOGON)\s+(\w+ \w+ \w+|\w+)\s+Success Audit\s+(\w+).+User Logoff:\s+User 
Name:\s(\w+\$|\s+|\w+)\s+Domain:\s(\w+|\s+)\s+Logon ID: 
(\(\S+,\S+\))\s+Logon Type:\s(\d+)/);

2. I create the a LML rule to use the new created regex 

regex=(540)\s+Security\s+(\w+|\w+\$|\w+\-\w+\$|ANONYMOUS LOGON)\s+(\w+
\w+ 
\w+|\w+)\s+Success Audit\s+(\S+).+Successful Network Logon:\s+User 
Name:\s(\w+\$|\s+|\w+)\s+Domain:\s(\w+|\s+)\s+Logon ID: 
(\(\S+,\S+\))\s+Logon Type:\s(\d+)\s+Logon Process:\s(\w+).+Workstation 
Name:\s(\s+|\w+)\s+Logon GUID:\s.+Source Network 
Address:\s(204.146.116.99)\s+Source Port: (\d+|-); \
 classification.text=Web Proxy Authentication; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=$1; \
 id=6003; \
 revision=1; \
 analyzer(0).name=SNARE; \
 
analyzer(0).manufacturer=http://www.intersectalliance.com/projects/Snare
Windows; 
\
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=$2 authenticated to Web Proxy ($6 domain
$4 
dc); \
 source(0).process.name=$9; \
 source(0).node.category=nt; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$11; \
 source(0).node.name=$10; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$2; \
 target(0).node.category=nt; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).node.name=$4; \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$2; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Logon Type; \
 additional_data(0).data=$8; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Logon ID; \
 additional_data(1).data=$7; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Authentication domain; \
 additional_data(2).data=$6; \

3.

-------------------------------------------------------------------
Justin Buhler, CISSP
Information Security Specialist

Zoot Enterprises, Inc    www.zootweb.com
555 Zoot Enterprises Lane
Bozeman, MT  59718
406-586-5050 x7455
direct: 406-556-7455  fax: 406-586-8005
Zoot Technical Support - 406-586-5050 x5 x2
-------------------------------------------------------------------

This email, including any attachments, is confidential and may not be 
redistributed without permission. If you are not an intended recipient, 
you have received this message in error, please notify us immediately by

replying to this message and deleting it from your computer. Thank you.
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user