Re: prelude-lml filter format

Hi Nicholas,

Le mardi 24 novembre 2009 à 13:24 -0600, Nicholas Nachefski a écrit :
> I'm attempting to write a prelude-lml log format rule for windows snare
> events and I need a second pair of eyes on this.
> 
> The reason i'm doing this is because "Detect Time" and "Analyzer Time" are
> showing up as the same in prelude, but are obviously two different
> timestamps(see the LOG below).
> 
> The first time stamp is the "Analyzer Time", which is the timestamp SNARE
> puts on the event(*- year*).  
> The second is the time that Windows stamps
> into the actual event log(*+ year*), in my opinion this should be the
> "Detect Time".

>From the IDMEF RFC:

1.  When an analyzer or manager sends an IDMEF message, it should
    place the current value of its time-of-day clock in an
    <AnalyzerTime> element.  This should occur as late as possible in
    the message transmission process, ideally right before the
    message is "put on the wire".

This is something libprelude will do for you, better not bother doing it
it on your side. However, setting CreateTime and DetectTime can be done
from the application. In your case, DetectTime should be the time when
Windows reported the event, and CreateTime the time when Snare generated
the alert for this event.

> In my prelude manager, I'm only getting the first time stamp(snare) for all
> three fields(Create time, Detect time, Analyzer time)
> 
> <snip from prelude-lml.conf>
> #LOG: *Nov 24 12:44:43* 10.1.1.2 testbox01        MSWinEventLog   1
> Security        154     Tue *Nov 24 12:44:36 2009*
> [format=snare_windows]
> time-format = "%b %d %H:%M:%S %Y"
> prefix-regex = "\w{3} \d{1,2}
> \d\d:\d\d:\d\d\s+\S*\s*(?P<hostname>\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d+\s+\w+(?P<timestamp>.{20})"
> file = /log/remote/windows/event.log
> 
> But, when i load this rule up i get the following from prelude-lml:
> 
> *prelude-lml: WARNING: no appropriate format defined for log entry:*
> 
> The time-format is definitely OK,
> *# date +"%b %d %H:%M:%S %Y"
> Nov 24 13:15:27 2009
> *
> and the prefix-regex matches when i put it though a perl interpreter, just
> not in my prelude-lml.conf.
> Also, i'm not sure what '?P' is, but i think it may be a custom tag used by
> LML to identify IDMEF content.
> 
> Any help would be greatly appreciated.

Is the above log example correct? If there's a wildcard after the
initial timestamp, '\s+' within your regex won't match the pattern. 

Regards,

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                       Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user