diff -r 55072a52aaa4 -r 673c04be67e9 etc/decoder.xml
--- a/etc/decoder.xml Wed Nov 04 20:51:36 2009 -0500
+++ b/etc/decoder.xml Fri Nov 06 19:53:36 2009 +0000
@@ -70,17 +70,16 @@
pam
rhost
^=(\S+)
srcip
-
+
+ ^\.gentless: Log:
+ ossec
+
+
+
+
+ agentless
+ ^fields=[
+ ^fields=[([^;]*);([^;]*);([^;]*);([^;]*);([^;]*);([^;]*);([^;]*);([^;]*)] (\S+)
+ id,srcip, dstip, srcport, dstport, protocol, action, status, extra_data
+
+
+
+ agentless
+ ^alert=\d+
+ ^alert=(\d+) (\.*)
+ id, extra_data
+
+
+
+
+
diff -r 55072a52aaa4 -r 673c04be67e9 etc/rules/agentless_rules.xml
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/etc/rules/agentless_rules.xml Fri Nov 06 19:53:36 2009 +0000
@@ -0,0 +1,100 @@
+
+
+
+
+
+
+
+ agentless
+ Agentless Logged Messages.
+
+
+ 10000
+ 1
+ Agentless: None
+
+
+ 10000
+ 1
+ Agentless: System low priority notification
+
+
+ 10000
+ 3
+ Agentless: Successful/Authorized events
+
+
+ 10000
+ 4
+ Agentless: System low priority error
+
+
+ 10000
+ 5
+ Agentless: User generated error
+
+
+ 10000
+ 6
+ Agentless: Low relevance attack
+
+
+ 10000
+ 7
+ Agentless: "Bad word" matching. They include words like "bad", "error", etc.
+
+
+ 10000
+ 8
+ Agentless: First time seen - Include first time seen events.
+
+
+ 10000
+ 9
+ Agentless: Error from invalid source
+
+
+ 10000
+ 10
+ Agentless: Multiple user generated errors
+
+
+ 10000
+ 11
+ Agentless: Integrity checking warning
+
+
+ 10000
+ 12
+ Agentless: High importancy event
+
+
+ 10000
+ 13
+ Agentless: Unusual error (high importance)
+
+
+ 10000
+ 14
+ Agentless: High importance security event
+
+
+ 10000
+ 15
+ Agentless: Severe attack
+
+
+
+
diff -r 55072a52aaa4 -r 673c04be67e9 etc/rules/ossec_rules.xml
--- a/etc/rules/ossec_rules.xml Wed Nov 04 20:51:36 2009 -0500
+++ b/etc/rules/ossec_rules.xml Fri Nov 06 19:53:36 2009 +0000
@@ -153,16 +153,23 @@
500
^ossec: agentless:
Integrity checksum for agentless device changed.
syscheck,agentless
+
+ 500
+ ^agentless: Log:
+ Agentless log event.
+ agentless
+
+
ossec
hostinfo_modified
Host information changed.
hostinfo,
diff -r 55072a52aaa4 -r 673c04be67e9 etc/templates/config/rules.template
--- a/etc/templates/config/rules.template Wed Nov 04 20:51:36 2009 -0500
+++ b/etc/templates/config/rules.template Fri Nov 06 19:53:36 2009 +0000
@@ -44,11 +44,12 @@
trend-osce_rules.xml
zeus_rules.xml
solaris_bsm_rules.xml
vmware_rules.xml
ms_dhcp_rules.xml
asterisk_rules.xml
ossec_rules.xml
+ agentless_rules.xml
attack_rules.xml
local_rules.xml
diff -r 55072a52aaa4 -r 673c04be67e9 src/agentlessd/scripts/nmap_policy
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/src/agentlessd/scripts/nmap_policy Fri Nov 06 19:53:36 2009 +0000
@@ -0,0 +1,59 @@
+#!/usr/bin/env python
+
+from subprocess import Popen, PIPE, STDOUT
+from xml.etree.ElementTree import parse, tostring, fromstring
+from optparse import OptionParser
+import sys
+
+def main():
+ usage = "usage: %prog [options] [Networks to Scan]"
+ parser = OptionParser(usage=usage)
+ parser.add_option('-b', '--badports', dest="badports", default="23,107,21", help="List of ports to scan for that are not allowed in policy Format is the same as nmap [U:53,111,137,T:21-25,80,139,8080]")
+ parser.add_option("-n", '--network', dest="network", help="Networking to scan for policy violations. Format is the same as nmap [10.0.0.0/24]")
+ parser.add_option("-d", '--debug', dest='debug', action="store_true", help="Enable debuging")
+ (options, args) = parser.parse_args()
+ if options.badports:
+ badPorts = options.badports
+ else:
+ badPorts = "T:23,107,21"
+ if options.network:
+ cmd = "nmap -p %s -oX - %s"%(badPorts, options.network)
+ elif args:
+ cmd = "nmap -p %s -oX - %s"%(badPorts, " ".join(args))
+ else:
+ parser.error("Networks to scan is required.")
+ print "INFO: Starting"
+ print "INFO: running `%s` command"%(cmd)
+ p = Popen(cmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=STDOUT, close_fds=True)
+ data = p.stdout.read()
+ if options.debug:
+ print data
+ print "INFO: completed `%s` command"%(cmd)
+ root = fromstring(data)
+ for aHost in root.findall("./host"):
+ for i in aHost.findall("./address"):
+ if "addrtype" in i.keys() and i.get("addrtype") == 'ipv4':
+ ipad = i.get("addr", None)
+ if "addrtype" in i.keys() and i.get("addrtype") == 'mac':
+ macad = i.get("addr", None)
+ macvendor = i.get("vendor", None)
+ else:
+ macad = ""
+ macvendor = ""
+
+ listofbad = {}
+ for i in aHost.findall("./ports/port"):
+ if i.find("./state") != None and i.find("./state").get("state") == "open":
+ if 'portid' in i.keys():
+ if i.find("./service") != None:
+ listofbad[i.get("portid")] = i.find("./service").get("name", None)
+ else:
+ listofbad[i.get("portid")] = "Unknown"
+
+ for i in listofbad:
+ print "LOG: alert=11 Policy violation port %s (%s) is open on host %s (%s %s)"%(i,listofbad[i], ipad, macad, macvendor)
+ print "INFO: Ending"
+
+if __name__ == '__main__':
+ main()
+