Re: Snare - Windows ruleset for Prelude-LML

Whoops, I pasted the old prefix regex, here is the one that is rock-solid
and works for both Windows <= 2003 and Windows 2008 (with or without syslog
headers enabled in snare)

#LOG: Jan  6 00:13:32 10.1.1.1 testbox01    MSWinEventLog    1
Security    3083899    Wed Jan 06 00:13:21 2010
#or
#LOG: Jan  6 00:13:32 testbox01        MSWinEventLog   1
Security        3083899 Wed Jan 06 00:13:21 2010

[format=snare_windows]
time-format = "%b %d %H:%M:%S %Y"
prefix-regex =
"\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+(?:\S+\s)*?(?P<hostname>\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d+\s+\w+\s+(?P<timestamp>.{20})"
file = /log/remote/windows/event.log



On Wed, Jan 6, 2010 at 12:12 PM, Nicholas Nachefski <[email protected]>wrote:

> No problem!
>
> BTW, here is the prelude-lml.conf prefix i use in conjunction with my
> snare_windows.rules.  It works well, with or without syslog headers enabled.
>
> #LOG: Jan  6 00:13:32 10.1.1.1 testbox01        MSWinEventLog   1
> Security        3083899 Wed Jan 06 00:13:21
> [format=snare_windows]
> time-format = "%b %d %H:%M:%S %Y"
> prefix-regex =
> "\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\S*\s*(?P<hostname>\S+)\s+MSWinEventLog\s+\d\s+\w+\s+\d+\s+\w+\s+(?P<timestamp>.{20})"
> file = /log/remote/windows/event.log
>
> -Nick
>
> On Mon, Jan 4, 2010 at 5:54 AM, Yoann Vandoorselaere <
> [email protected]> wrote:
>
>> Hi Nicholas,
>>
>> Le lundi 30 novembre 2009 à 12:42 -0600, Nicholas Nachefski a écrit :
>> > Here is the latest beta version of the Snare/Windows ruleset for use
>> with
>> > Prelude-LML.  I've made the corrections recommended by the community and
>> > developers.  The Win 2003 rules are pretty stable and well tested,
>> however,
>> > the 2008 ruleset will probably require further development.
>> >
>> > Let me know if there are any other suggestions that you think i should
>> > consider.
>>
>> Thanks for the update!
>>
>> I'm currently considering the ruleset for inclusion, there was a little
>> modification necessary to rules ID 99992 to prevent it from triggering a
>> warning on an invalid process PID.
>>
>> Aditionally, is there any reason why IP address are matched using:
>>
>> (?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)
>>
>> In place of the following, which should work both for IPv[46] :
>> (\S+)
>>
>>
>> Thank you very much for your work!
>>
>> --
>> Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
>> Tel: +33 (0)1 40 24 65 10                      Fax: +33 (0)1 40 24 65 28
>> http://www.prelude-ids.com
>>
>>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user