Re: [ossec-list] Re: Active response not working for rule_id 554 with "filename" as expect

2022-03-03 Thread Manuel Camona Perez
Hi again,

Which Wazuh version are you using? I suppose that you are using *4.1* or a 
previous version as from *4.2*, active response custom scripts work 
differently.

I have been testing your active response configuration and scripts are 
being executed properly, as you said.

As you can see in the following logs, your script is logging the call to 
*/var/ossec/logs/active-responses.log* for both rule with ID 550 and rule 
with ID 554:


*Thu Mar  3 15:45:32 UTC 2022 
/var/ossec/active-response/bin/syscheck-all.sh add - - 1646322332.560567 
550 syscheck /test/b -Thu Mar  3 15:45:34 UTC 2022 
/var/ossec/active-response/bin/syscheck-all.sh add - - 1646322334.560819 
554 syscheck /test/c -*


This is the output of doing 


*printf "$(date) $0 $1 $2 $3 $4 $5 $6 $7 $8\n" >> 
${PWD}/../logs/active-responses.log*
in *syscheck-all.sh* (line 37 

)

We can see that each script argument refers to a component. These arguments 
are the following (in this order) (ref: 
https://documentation.wazuh.com/4.1/user-manual/capabilities/active-response/remediation-faq.html#can-i-use-a-custom-script-for-active-responses
):



*   *

** is the name of the script file that is going to be run.

** can be delete or add.

** is the user name. It can be - if not set.

** is the source IP. It can be - if not set.

** is the alert ID (unique for every alert).

** is the rule ID.

** is the agent ID or hostname.

** is the source path file of the log that triggered the alert 
(if it exists).

With this information, we know that

- $0 is the script name: /var/ossec/active-response/bin/syscheck-all.sh
- $1 is the action: add
- $2 is the user: -
- $3 is the IP: -
- $4 is the alert ID: 1646322332.560567 and 1646322334.560819
- $5 is the rule ID: 550 and 554
- $6 is the agent: syscheck
- $7 is the filename: /test/b and /test/c


Note that in this case, we have the *service* (*syscheck*) instead of 
*agent* because we are using *syscheck* rules.


Summarizing, I am receiving the *FILENAME* for both rules (*$7*). 


What is being logged in your agents' */var/ossec/logs/active-responses.log* 
file? Having a look at that output will help you know which argument is the 
*filename*. In your script, *filename* is expected to be *$8*. You can 
confirm whether *filename* is at *$8* or not by having a look at the log 
file, as I said.

I hope this helps, please if you have more problems, send the 
*/var/ossec/logs/active-responses.log* output. Also, have a look at the 
*ossec.log* file with *execd* in debug mode (how to enable debug mode is in 
the last comment).

On Thursday, March 3, 2022 at 2:11:39 PM UTC+1 AKSHA GANDHI wrote:

> Hi,
> We are using AlienVault Version: OSSIM 5.7.4
> For scripts we are referring to : https://github.com/jonschipp/nsm-tools/
> The script is getting executed but we are not receiving FILENAME parameter 
> when RULE ID 554 is getting triggered.
>
> Thanks in advance.
>
> On Thu, Mar 3, 2022 at 5:45 PM Manuel Camona Perez  
> wrote:
>
>> Hi Aksha and sorry for the late response,
>>
>> I will try to help you solve this issue. I need some information to test 
>> your use case and see what is happening. 
>>
>> First of all, could you tell me which Wazuh version you are using? Also, 
>> it would be fine if you send the active response script you are trying to 
>> execute.
>>
>> In order to troubleshoot this, I recommend that you enable the debug mode 
>> for the *execd* daemon, which is the one in charge of executing active 
>> response scripts. In order to do it, add the following line to 
>> */var/ossec/etc/local_internal_options.conf*:
>>
>>
>> *execd.debug=2*
>> Waiting for your response!
>>
>> On Wednesday, March 2, 2022 at 7:16:14 AM UTC+1 AKSHA GANDHI wrote:
>>
> Hi Ossec Team, 
>>>
>>> Can anyone please review this and help.
>>>
>>> Thanks in Advance.
>>> Aksha 
>>> On Friday, February 25, 2022 at 7:17:18 PM UTC+5:30 AKSHA GANDHI wrote:
>>>
 Hi,
 1. Active response is getting triggered for both Rule ID 550,554 if 
  parameter is kept blank. 2.If  parameter  is given 
 value FILENAME then active response is not getting triggered for RULE ID 
 554 but is getting triggered for RULE ID 550. 3. Not receiving any 
 error logs. 4. Kindly find the details of the ossec.conf file for 
 which Active response is not getting trigerred for RULE ID 554.

  ossec.conf -
  Test syscheck-all.sh 
 FILENAME   
 no Test 
 defined-agent 78 
 554,550 

 --- ossec.conf ---
 Please help troubleshot the issue.

 Thanks & Regards
 Aksha

>>> -- 
>>
>> --- 
>> You received this message because you are subscribed to the Google Groups 
>> "ossec-list" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to ossec-list+...@googlegroups.com.
>> To view this discussion on the web visit 
>> 

Re: [ossec-list] Re: Active response not working for rule_id 554 with "filename" as expect

2022-03-03 Thread 'Aksha Gandhi | Information Security' via ossec-list
Hi,
We are using AlienVault Version: OSSIM 5.7.4
For scripts we are referring to : https://github.com/jonschipp/nsm-tools/
The script is getting executed but we are not receiving FILENAME parameter
when RULE ID 554 is getting triggered.

Thanks in advance.

On Thu, Mar 3, 2022 at 5:45 PM Manuel Camona Perez 
wrote:

> Hi Aksha and sorry for the late response,
>
> I will try to help you solve this issue. I need some information to test
> your use case and see what is happening.
>
> First of all, could you tell me which Wazuh version you are using? Also,
> it would be fine if you send the active response script you are trying to
> execute.
>
> In order to troubleshoot this, I recommend that you enable the debug mode
> for the *execd* daemon, which is the one in charge of executing active
> response scripts. In order to do it, add the following line to
> */var/ossec/etc/local_internal_options.conf*:
>
>
> *execd.debug=2*
> Waiting for your response!
>
> On Wednesday, March 2, 2022 at 7:16:14 AM UTC+1 AKSHA GANDHI wrote:
>
>> Hi Ossec Team,
>>
>> Can anyone please review this and help.
>>
>> Thanks in Advance.
>> Aksha
>> On Friday, February 25, 2022 at 7:17:18 PM UTC+5:30 AKSHA GANDHI wrote:
>>
>>> Hi,
>>> 1. Active response is getting triggered for both Rule ID 550,554 if
>>>  parameter is kept blank. 2.If  parameter  is given
>>> value FILENAME then active response is not getting triggered for RULE ID
>>> 554 but is getting triggered for RULE ID 550. 3. Not receiving any
>>> error logs. 4. Kindly find the details of the ossec.conf file for which
>>> Active response is not getting trigerred for RULE ID 554.
>>>
>>>  ossec.conf -
>>>  Test syscheck-all.sh
>>> FILENAME  
>>> no Test
>>> defined-agent 78
>>> 554,550 
>>>
>>> --- ossec.conf ---
>>> Please help troubleshot the issue.
>>>
>>> Thanks & Regards
>>> Aksha
>>>
>> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/ossec-list/70ad8924-11df-43cb-a543-5ca4f96a40a0n%40googlegroups.com
> 
> .
>

-- 
Disclaimer: Privileged & confidential information is contained in this 
message (including all attachments). If you are not an intended recipient 
of this message, please destroy this message immediately and kindly notify 
the sender by reply e-mail. Any unauthorized use or dissemination of this 
message in any manner whatsoever, in whole or in part, is strictly 
prohibited. This e-mail, including all attachments hereto, is for 
discussion purposes only and shall not be deemed or construed otherwise 
unless expressly stated. Any views or opinions presented in this email are 
solely those of the author and do not necessarily represent that of NJ 
Group of Companies. This communication, including any attachments may not 
be free of viruses, interceptions or interference, and may not be 
compatible with your systems. You should carry out your own virus checks 
before opening any attachment to this e-mail. The sender of this e-mail and 
NJ Group of Companies shall not be liable for any damage that you may 
sustain as a result of viruses, incompleteness of this message, a delay in 
receipt of this message or computer problems experienced. This message has 
been scanned for viruses and dangerous content by NJGroup Email Server, and 
is believed to be clean.

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/ossec-list/CADrFDiPVGvF8sNGQb3v7CMvATbJqosUX4ctvYXbM8vjk2qGdTA%40mail.gmail.com.


[ossec-list] Re: HELP ME DECODE THIS LOG (check Authen)

2022-03-03 Thread Yana Zaeva


Hi,

My apologies for the late response. You could start creating decoders 
following this example:


 ^\w+,\w+,\w+.



 ossec_custom
 \w+,(\w+),(\w+.\w+.\w+.\w+):(\d+),
 info, srcip, srcport



 ossec_custom
 (\w+.\w+.\w+.\w+):(\d+),(\w+),
 dstip, dstport, user


Ossec logtest output:

Type one log per line

2018-08-26T00:00:03.269Z,000EE085,2,xxx.xxx.xxx.4:995,xxx.xxx.xxx.234:50956,ngapt,2,10,56,pass,*,"R=""-ERR
 Logon failure: unknown user name or bad 
password."";Msg=LogonFailed:LogonDenied;ErrMsg=LogonFailed:LogonDenied"

**Phase 1: Completed pre-decoding.
full event: 
'2018-08-26T00:00:03.269Z,000EE085,2,xxx.xxx.xxx.4:995,xxx.xxx.xxx.234:50956,ngapt,2,10,56,pass,*,"R=""-ERR
 Logon failure: unknown user name or bad 
password."";Msg=LogonFailed:LogonDenied;ErrMsg=LogonFailed:LogonDenied"'
timestamp: '2018-08-26T00:00:03.269Z,00'

**Phase 2: Completed decoding.
name: 'ossec_custom'
dstip: 'xxx.xxx.xxx.234'
dstport: '50956'
dstuser: 'ngapt'
info: '2'
srcip: 'xxx.xxx.xxx.4'
srcport: '995'

Also, I would like to leave here some links that you might find helpful:

   - Creating custom decoders 
   
   . 
   - Decoders syntax. 
   

 

Hope this was helpful. Let me know if you need anything else.

Regards,
Yana.
​
On Thursday, September 20, 2018 at 1:43:51 PM UTC+2 phamanh...@gmail.com 
wrote:

> Hi Everybody, after I use log-test with these log but no result, please 
> anyone help me decode this!!!
>
> POP3:
> 2018-08-26T00:00:03.269Z,000EE085,2,xxx.xxx.xxx.4:995,xxx.xxx.xxx.234:50956,ngapt,2,10,56,pass,*,"R=""-ERR
>  
> Logon failure: unknown user name or bad 
> password."";Msg=LogonFailed:LogonDenied;ErrMsg=LogonFailed:LogonDenied"
>
> Imap4: 
> 2018-08-25T00:01:41.052Z,000187EB,2,xxx.xxx.xxx.4:993,xxx.xxx.xxx.5:52332,trunghq,706,26,26,login,trunghq
>  
> *,"R=ok;Msg=""Proxy:DOMAIN.NAME:9933:SSL;ProxySuccess"";ActivityContextData=acf5cf60-96e0-4d4e-a6b6-1ff897e8148a"
>
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/ossec-list/c9c13568-bea7-4c33-8283-b0a4d42f27f1n%40googlegroups.com.


[ossec-list] Re: Active response not working for rule_id 554 with "filename" as expect

2022-03-03 Thread Manuel Camona Perez
Hi Aksha and sorry for the late response,

I will try to help you solve this issue. I need some information to test 
your use case and see what is happening. 

First of all, could you tell me which Wazuh version you are using? Also, it 
would be fine if you send the active response script you are trying to 
execute.

In order to troubleshoot this, I recommend that you enable the debug mode 
for the *execd* daemon, which is the one in charge of executing active 
response scripts. In order to do it, add the following line to 
*/var/ossec/etc/local_internal_options.conf*:


*execd.debug=2*
Waiting for your response!

On Wednesday, March 2, 2022 at 7:16:14 AM UTC+1 AKSHA GANDHI wrote:

> Hi Ossec Team, 
>
> Can anyone please review this and help.
>
> Thanks in Advance.
> Aksha 
> On Friday, February 25, 2022 at 7:17:18 PM UTC+5:30 AKSHA GANDHI wrote:
>
>> Hi,
>> 1. Active response is getting triggered for both Rule ID 550,554 if 
>>  parameter is kept blank. 2.If  parameter  is given 
>> value FILENAME then active response is not getting triggered for RULE ID 
>> 554 but is getting triggered for RULE ID 550. 3. Not receiving any error 
>> logs. 4. Kindly find the details of the ossec.conf file for which Active 
>> response is not getting trigerred for RULE ID 554.
>>
>>  ossec.conf -
>>  Test syscheck-all.sh 
>> FILENAME   
>> no Test 
>> defined-agent 78 
>> 554,550 
>>
>> --- ossec.conf ---
>> Please help troubleshot the issue.
>>
>> Thanks & Regards
>> Aksha
>>
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/ossec-list/70ad8924-11df-43cb-a543-5ca4f96a40a0n%40googlegroups.com.


[ossec-list] Re: Active response not working for rule_id 554 with "filename" as expect

2022-03-03 Thread Manuel Camona Perez
Hi Aksha and sorry for the late response,

I will try to help you solve this issue. I need some information to test 
your use case and see what is happening. 

First of all, could you tell me which Wazuh version you are using? Also, it 
would be fine if you send the active response script you are trying to 
execute.

In order to troubleshoot this, I recommend that you enable the debug mode 
for the *execd* daemon, which is the one in charge of executing active 
response scripts. In order to do it, add the following line to 
*/var/ossec/etc/local_internal_options.conf*:


*execd.debug=2*
Waiting for your response!

On Wednesday, March 2, 2022 at 7:16:14 AM UTC+1 AKSHA GANDHI wrote:

> Hi Ossec Team, 
>
> Can anyone please review this and help.
>
> Thanks in Advance.
> Aksha 
> On Friday, February 25, 2022 at 7:17:18 PM UTC+5:30 AKSHA GANDHI wrote:
>
>> Hi,
>> 1. Active response is getting triggered for both Rule ID 550,554 if 
>>  parameter is kept blank. 2.If  parameter  is given 
>> value FILENAME then active response is not getting triggered for RULE ID 
>> 554 but is getting triggered for RULE ID 550. 3. Not receiving any error 
>> logs. 4. Kindly find the details of the ossec.conf file for which Active 
>> response is not getting trigerred for RULE ID 554.
>>
>>  ossec.conf -
>>  Test syscheck-all.sh 
>> FILENAME   
>> no Test 
>> defined-agent 78 
>> 554,550 
>>
>> --- ossec.conf ---
>> Please help troubleshot the issue.
>>
>> Thanks & Regards
>> Aksha
>>
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/ossec-list/f12d9c95-b16f-44d1-97d9-42afaf626cb4n%40googlegroups.com.