Re: Snare - Windows ruleset for Prelude-LML

No problem!

BTW, here is the prelude-lml.conf prefix i use in conjunction with my
snare_windows.rules.  It works well, with or without syslog headers enabled.

#LOG: Jan  6 00:13:32 10.1.1.1 testbox01        MSWinEventLog   1
Security        3083899 Wed Jan 06 00:13:21
[format=snare_windows]
time-format = "%b %d %H:%M:%S %Y"
prefix-regex =
"\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\S*\s*(?P<hostname>\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d+\s+\w+\s+(?P<timestamp>.{20})"
file = /log/remote/windows/event.log

-Nick

On Mon, Jan 4, 2010 at 5:54 AM, Yoann Vandoorselaere <
[email protected]> wrote:

> Hi Nicholas,
>
> Le lundi 30 novembre 2009 à 12:42 -0600, Nicholas Nachefski a écrit :
> > Here is the latest beta version of the Snare/Windows ruleset for use with
> > Prelude-LML.  I've made the corrections recommended by the community and
> > developers.  The Win 2003 rules are pretty stable and well tested,
> however,
> > the 2008 ruleset will probably require further development.
> >
> > Let me know if there are any other suggestions that you think i should
> > consider.
>
> Thanks for the update!
>
> I'm currently considering the ruleset for inclusion, there was a little
> modification necessary to rules ID 99992 to prevent it from triggering a
> warning on an invalid process PID.
>
> Aditionally, is there any reason why IP address are matched using:
>
> (?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)
>
> In place of the following, which should work both for IPv[46] :
> (\S+)
>
>
> Thank you very much for your work!
>
> --
> Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
> Tel: +33 (0)1 40 24 65 10                      Fax: +33 (0)1 40 24 65 28
> http://www.prelude-ids.com
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user