Re: Problem handling a new sensor with prelude-lml

Hey Philippe,

To gives you a better overview, here's an example of an OpenVAS log I'm
> trying to catch:
> ||
> [Thu May 18 13:42:39 2010] results|192.168.2|192.168.2.6|https
> (443/tcp)|1.3.6.1.4.1.25623.1.0.900186|Security Warning| TEST T
> EST TEST TEST |Risk factor: low |CVE : CVE-2008-5498 |BID : 33002|
> |
> ||And here is what i did so far:|
> |
> 1. I added a new format to the prelude-lml.conf ==>
>
> [format=openvas]
> time-format = "%a %b %d %H:%M:%S %Y"
> prefix-regex = "^\[(?P<timestamp>.{24})\] "
> file = /var/log/openvas/scan-log
>
> 2. I added a new rules for OpenVAS and register it in pcre.rules ==>
>
> [snippet from: ruleset/pcre.rules]
> regex=openvasd;                         include = openvasd.rules;
>
>
I don't really do much with adding in non-syslog files for watching with
LML, however, the regex you specified pcre.rules doesn't match the sample
log line you provided - so in the very least rules in openvasd.rules will
not be applied to it.  The regex in pcre.rules is used to find something
that will be in all your log messages and is used to limit the number of LML
rules that get applied to each log message LML sees.

On a different note, depending on how comfortable you are with something
like Perl or Python, the Prelude Easy Bindings would easily allow you to
craft your own agent and get the data however you wanted into Prelude.  The
Easy Bindings are fantastic and have made my life alot easier, :).

See here for more easy bindings examples:

https://dev.prelude-technologies.com/wiki/prelude/DevelAgentBuilding#Using-Python

Scott
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user