On Fri, Nov 16, 2018 at 4:12 AM Николай Сеньков <nikolay.sen...@gmail.com> wrote: > > Hello, > > In ossec agent log for same host (PDS2) alert for different event is not > resolved srcip in ip or asset name > > AV - Alert - "1542351904" --> RID: "5715"; RL: "3"; RG: > "syslog,sshd,authentication_success,"; RC: "SSHD authentication success."; > USER: "oracle"; SRCIP:"172.20.191.17"; HOSTNAME: "pds2"; LOCATION: > "/var/log/auth.log"; EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]: > Accepted publickey for oracle from 172.20.191.17 port 61956 ssh2[END]"; >
This one looks like it's parsing properly., > AV - Alert - "1542351904" --> RID: "5501"; RL: "3"; RG: > "pam,syslog,authentication_success,"; RC: "Login session opened."; USER: > "None"; SRCIP: "None"; HOSTNAME: "pds2"; LOCATION: "/var/log/auth.log"; > EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]: pam_unix(sshd:session): > session opened for user oracle by (uid=0)[END]"; > This one has no IP to parse, although there is a user. Adding this after the pam decoder seems to work for me (but I haven't made sure nothing else breaks): <decoder name="pam-ssh"> <parent>pam</parent> <prematch>^pam_unix\(sshd:\w+\): </prematch> <regex offset="after_prematch">^session \w+ for user (\S+) </regex> <order>user</order> </decoder> > 2018-11-16 00:05:02,134 Detector [WARNING]: ssh[4003] Event's field dst_ip > pds2 is not a valid IP.v4/IP.v6 address, falling back to default: 0.0.0.0 > > 2018-11-16 00:05:02,135 Detector [WARNING]: ssh[4003] Event's device field > pds2 is not a valid IP.v4/IP.v6 address, falling back to default local. > There's no decoder for these at all. What are the log messages from? > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
