Problem handling a new sensor with prelude-lml

|Hello everyone,

This is my first post to the mailing-list, I've been trying to get some
support over IRC but it turns out Yoann suggests me to describe problems
i encounter over the mailing-list, so here i am :)

I'll try to keep this as short as i can (but i doubt i will be able to
do it)... Lately I've been trying to integrate a new sensor to Prelude,
it's called OpenVAS - an Open Vulnerability Assessment System. At the
first view, the task appears to be easy and basically i just have to
write up a new set of rules to catch alerts with PCRE engine.

My first strategy was to pipe OpenVAS alerts through the syslog engine
with the 'logger' utility. But it appears that lot of my alerts were
truncated because of the 1024 bytes limit of syslog. Those under 1024
bytes works very well, so it means that rules i wrote for prelude-lml
are good.

So now to overcome this limitation i had to create a new log format for
OpenVAS, which i did but now i have other problems, and a very hard time
to debug.

To gives you a better overview, here's an example of an OpenVAS log I'm
trying to catch:
||
[Thu May 18 13:42:39 2010] results|192.168.2|192.168.2.6|https
(443/tcp)|1.3.6.1.4.1.25623.1.0.900186|Security Warning| TEST T
EST TEST TEST |Risk factor: low |CVE : CVE-2008-5498 |BID : 33002|
|
||And here is what i did so far:|
|
1. I added a new format to the prelude-lml.conf ==>

[format=openvas]
time-format = "%a %b %d %H:%M:%S %Y"
prefix-regex = "^\[(?P<timestamp>.{24})\] "
file = /var/log/openvas/scan-log

2. I added a new rules for OpenVAS and register it in pcre.rules ==>

[snippet from: ruleset/pcre.rules]
regex=openvasd;                         include = openvasd.rules;

[snippet from: ruleset/openvasd.rules]
||(I know my regex is very ugly, but it works!... any improvements are
very welcome!!)|
|
#LOG: results|192.168.2|192.168.2.6|https
(443/tcp)|1.3.6.1.4.1.25623.1.0.900186|Security Warning| TEST TEST TEST
TEST |Risk factor: low |CVE : CVE-2008-5498 |BID : 33002
regex=results\|(.*)\|(.*)\|(.*)\|(.*)\|(.*)\|(.*)\|Risk factor[: ][:
](.*)\|CVE[: ][: ](.*)\|BID[: ][: ](.*); \
classification.text=OpenVAS Alert Generated.; \
id=001; \
revision=1; \
analyzer(0).name=openvasd; \
analyzer(0).manufacturer=OpenVAS; \
analyzer(0).class=Vulnerability scanner; \
assessment.impact.type=other; \
assessment.impact.severity=$7; \
assessment.impact.description=$5 - $6; \
target(0).node.address(0).address=$2; \
target(0).node.address(0).category=ipv4-addr; \
target(0).service.name=$3; \
additional_data(0).type=string; \
additional_data(0).meaning=NVT id; \
additional_data(0).data=$4; \
classification.reference(0).origin=cve; \
classification.reference(0).name=$8; \
#classification.reference(0).url=http://osvdb.org/show/osvdb/$3; \
classification.reference(1).origin=bugtraqid; \
classification.reference(1).name=$9; \
#classification.reference(1).url=http://osvdb.org/show/osvdb/$3; \
last;

3. I restart prelude-lml service but nothing happens, and no alerts are
generated. When i do a "cat scan-log.nbe | logger -t openvasd"
everytings works well when it gets the log from /var/log/messages, but
no alerts are generated from /var/log/openvas/scan-log.nbe.

The files seems to be properly handle because when I delete it, I get
this alert ==>

* Impact severity: info
* Impact completion: succeeded
* Impact type: file
* Impact description: An attacker might have erased the logfile,or a log
rotation program may have rotated the logfile.
*
*
*
*** Target information
********************************************************
* Target decoy: unknown
* File original:  name=scan-log.nbe path=/var/log/openvas/scan-log.nbe
dsize=192
* mtime=: 0xcf9d5ca6.0x00000000 (2010-05-18 14:36:22.0+00:00)
* atime=: 0xcf9d5e63.0x00000000 (2010-05-18 14:43:47.0+00:00)
* Inode: number=1392782
* File current:  name=scan-log.nbe path=/var/log/openvas/scan-log.nbe
dsize=192
* mtime=: 0xcf9d5ca6.0x00000000 (2010-05-18 14:36:22.0+00:00)
* atime=: 0xcf9d5e63.0x00000000 (2010-05-18 14:43:47.0+00:00)

=======

I tried to explain my problems the best I can, but if you need other
information don't hesitate to ask me. Now that I'm stuck, I am really
looking forward to have some help. Any kind of help will be very
appreciated!

Thanks a lot!


--Philippe Blondin


|

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user

begin:vcard
fn:Philippe Blondin
n:Blondin;Philippe
org:Gardien Virtuel inc.
email;internet:[email protected]
title;quoted-printable:Analyste en s=C3=A9curit=C3=A9 TI
x-mozilla-html:FALSE
version:2.1
end:vcard