Help with Rules file to support Vyatta Firewall logs
Ron Rosson <[email protected]> Wed, 18 Aug 2010 10:03:47 -0500
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
I am looking at moving to prelude from a different opensource SIEM and the only thing that is holding me back is the parsing of Vyatta's firewall logs does not look to be supported. I have provided a log sample below of what the firewall log entries look like. From my investigation it looks like I just need to find the correct regular expression for the action (Accept, Drop,Reject) the firewall takes. #Accept #Dec 11 16:50:31 vyatta kernel: [ 936.677646] [wan-local-120-A] IN=eth1 OUT= MAC=00:30:48:de:ce:01:00:25:3c:8d:a6:59:08:00 SRC=75.9.51.236 DST=99.49.XX.XX LEN=136 TOS=0x00 PREC=0x00 TTL=55 ID=8141 PROTO=ESP SPI=0x9f9f37f4 #Drop #Dec 11 16:47:18 vyatta kernel: [ 743.708685] [wan-in-9998-D] IN=eth1 OUT=eth1 SRC=174.36.30.9 DST=192.168.XXX.XXX LEN=250 TOS=0x00 PREC=0x00 TTL=49 ID=26630 DF PROTO=TCP SPT=80 DPT=56677 WINDOW=54 RES=0x00 ACK PSH URGP=0 #Reject #Dec 11 16:47:18 vyatta kernel: [ 743.708685] [lan-untrusted-10-R] IN=eth1.100 OUT=eth2 SRC= 192.168.XXX.XXX DST=174.36.30.9 LEN=250 TOS=0x00 PREC=0x00 TTL=49 ID=26630 DF PROTO=TCP SPT=80 DPT=56677 WINDOW=54 RES=0x00 ACK PSH URGP=0 TIA -Ron _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-technologies.com/mailman/listinfo/prelude-user