On Mon, Jul 1, 2013 at 2:07 PM, David Blanton <[email protected]> wrote: > Wow - thanks Dan. Is there a link to all the variables that can be used in > decoders for future reference? I find the original PDF lacking. >
Not off hand. I'll try to work on that part of the documentation soon. > > On Monday, July 1, 2013 11:32:08 AM UTC-4, dan (ddpbsd) wrote: >> >> On Mon, Jul 1, 2013 at 10:52 AM, David Blanton >> <[email protected]> wrote: >> > Ideally, I would like the decoder to just look for 'FAILED : ' >> > >> > could it also be like this? >> > >> > <decoder name="bnc"> >> > <prematch>FAILED : \d+</prematch> >> > >> > </decoder> >> > >> >> Both of these decoders are bad. The first one didn't have an "<order>" >> after the regex, and this one is way too broad IMO. >> >> With the limited sample size, I've gotten this to work: >> <decoder name="bnc-decoder"> >> <prematch>^\d+-\d+: \S+ \d+-\d+ \d+-\d+ \S+ </prematch> >> <regex offset="after_prematch">^(\S+): \S(\d+)$</regex> >> <order>status, extra_data</order> >> </decoder> >> >> 2013/07/01 11:24:32 ossec-testrule: INFO: Reading local decoder file. >> 2013/07/01 11:24:32 ossec-testrule: INFO: Started (pid: 25839). >> ossec-testrule: Type one log per line. >> >> >> >> **Phase 1: Completed pre-decoding. >> full event: '119445-00025: P31128449pdf9030215.zip 0312-3 >> 11-28449 pdf903 FAILED: -351' >> hostname: 'arrakis' >> program_name: '(null)' >> log: '119445-00025: P31128449pdf9030215.zip 0312-3 11-28449 >> pdf903 FAILED: -351' >> >> **Phase 2: Completed decoding. >> decoder: 'bnc-decoder' >> status: 'FAILED' >> extra_data: '351' >> >> **Phase 3: Completed filtering (rules). >> Rule id: '1002' >> Level: '2' >> Description: 'Unknown problem somewhere in the system.' >> **Alert to be generated. >> >> >> >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/groups/opt_out. >> > >> > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
