# Ruleset Definitions
# Version 1.46 - marked syslog.cplog2.qradar as defunct
 
# Write local messages to disk
ruleset(name="var.log") {
    # Log all kernel messages to the console
    kern.*                                                 /dev/console

    # Log anything (except mail) of level info or higher
    *.info;mail.none;authpriv.none;cron.none                /var/log/messages

    # The authpriv file has restricted access
    authpriv.*                                              /var/log/secure

    # Log all the mail messages in one place
    mail.*                                                  -/var/log/maillog

    # Log cron stuff
    cron.*                                                  -/var/log/cron

    # Everybody gets emergency messages
    *.emerg                                                  :omusrmsg:*

    # Save news errors of level crit and higher in a special file
    uucp,news.crit                                          /var/log/spooler

    # Save boot messages also to boot.log
    local7.*                                                /var/log/boot.log
}

# Forward performance statistics to omsagent to Sentinel
ruleset(name="pstats.omsagent"
        queue.type="linkedlist"
        queue.filename="pstats_omsagent"
        queue.maxdiskspace="100m"
        queue.saveonshutdown="on"
       ) {

        action(name="forward" 
               type="omfwd"
               action.resumeretrycount="-1"
               target="127.0.0.1" 
               port="25224" 
               protocol="udp"
              )
}

# Write performance statistics to disk
ruleset(name="pstats.local"
        queue.type="fixedarray"
        queue.filename="pstats_local"
        queue.maxdiskspace="100m"
        queue.saveonshutdown="on"
       ) {

        action(name="write" 
               type="omfile"
               file="/var/log/rsyslog/pstats"
               iobuffersize="64k"
               flushontxend="off" 
               asyncwriting="on"
              )
}

# DEFUNCT Forward CEF messages to omsagent 
ruleset(name="cef.omsagent"
        queue.type="linkedlist"
        queue.filename="cef_omsagent"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {

        action(name="forward"
               type="omfwd" 
               action.resumeretrycount="-1"
               target="127.0.0.1" 
               port="25226" 
               protocol="tcp"
              )
}

# syslog.qradar - Forward syslog messages to qradar
ruleset(name="syslog.qradar"
        queue.type="linkedlist"
        queue.filename="syslog_qradar"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {
            action(name="forward"
                   type="omfwd"
                   queue.type="linkedlist"
                   action.resumeretrycount="-1"
                   target="XXX.XXX.XXX.XXX"
                   port="514"
                   protocol="tcp"
                  )
}

# syslog.cplog2.qradar - send events to 8.246 Data Gateway port 521 TCP
# This is DEFUNCT as of 5/20/22 as CPLOG2 events are no longer being set to QRoC
ruleset(name="syslog.cplog2.qradar"
        queue.type="linkedlist"
        queue.filename="syslog_cplog2_qradar"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {
            action(name="forward"
                   type="omfwd" 
                   queue.type="linkedlist" 
                   action.resumeretrycount="-1"
                   target="XXX.XXX.XXX.XXX" 
                   port="521" 
                   protocol="tcp"
                  )
}


# syslog.kiwi - Forward syslog messages to kiwi using OMUDPSPOOF - DEFUNCT
ruleset(name="syslog.kiwi"
        queue.type="linkedlist"
        queue.filename="syslog_kiwi"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {
            action(
                   type="omudpspoof"
                   target="XXX.XXX.XXX.XXX"
                   sourcetemplate="forward.message"
                   sourceport.start="514"
                   sourceport.end="1517"
                   port="514"
                  )
}

# syslog.kiwi2 - Forward syslog messages to kiwi without OMUDPSPOOF
ruleset(name="syslog.kiwi2"
        queue.type="linkedlist"
        queue.filename="syslog_kiwi2"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {
            action(name="forward"
                   type="omfwd"
                   queue.type="linkedlist"
                   action.resumeretrycount="-1"
                   template="TraditionalFwdWithIP"
                   target="XXX.XXX.XXX.XXX"
                   port="514"
                   protocol="udp"
                  )

}

# kiwi.local - Write Kiwi messages to disk
ruleset(name="kiwi.local"
        queue.type="fixedarray"
        queue.filename="kiwi_local"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {

        action(name="write"
               type="omfile"
               dynafile="kiwi.file"
# Will use the builtin:omfile which uses TraditionalFwdWithIP template instead
#              template="kiwi.message"
               iobuffersize="64k"
               flushontxend="off"
               asyncwriting="on"
              )
}

# DEFUNCT Write CEF messages to disk
ruleset(name="cef.local"
        queue.type="fixedarray"
        queue.filename="cef_local"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {

        action(name="write"
               type="omfile" 
               dynafile="cef.file"
               template="cef.message"
               iobuffersize="64k"
               flushontxend="off" 
               asyncwriting="on"
              )
}

# qradar.local - Write QRADAR messages to disk
ruleset(name="qradar.local"
        queue.type="fixedarray"
        queue.filename="qradar_local"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {

        action(name="write"
               type="omfile"
               dynafile="qradar.file"
# Will use the builtin:omfile which uses TraditionalFwdWithIP template instead
#               template="qradar.message"
               iobuffersize="64k"
               flushontxend="off"
               asyncwriting="on"
              )
}


# Forward ZPA messages to omsagent
ruleset(name="zpa.omsagent"
        queue.type="linkedlist"
        queue.filename="zpa_omsagent"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {

        action(name="forward" 
               type="omfwd"
               action.resumeretrycount="-1" 
               target="127.0.0.1" 
               port="22033" 
               protocol="tcp" 
               template="zpa.message"
              )
}

# Write ZPA messages to disk
ruleset(name="zpa.local"
        queue.type="fixedarray"
        queue.filename="zpa_local"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {

        action(name="write"
               type="omfile"
               dynafile="zpa.file"
# Will use the builtin:omfile which uses TraditionalFwdWithIP template instead
#               template="zpa.message"
               iobuffersize="64k"
               flushontxend="off" 
               asyncwriting="on" 
              )
}

# Forward Syslog messages to omsagent
# OMUDPSPOOF is still being used - see 10-modules for explanation 
ruleset(name="syslog.omsagent"
        queue.type="linkedlist"
        queue.filename="syslog_omsagent"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {

# If event is CEF or ASA, send out to OMSAGENT CEF via 25226 UDP
# Otherwise, send out to OMSAGENT SYSLOG processor via 25224 UDP
	if ($rawmsg contains "CEF:" or $rawmsg contains "ASA-")
	 then {
          action(
               type="omudpspoof" 
               target="127.0.0.1" 
               sourcetemplate="forward.message"
               sourceport.start="514"
               sourceport.end="1517" 
               port="25226"
               ) 
	}
	else {
          action(
               type="omudpspoof"
               target="127.0.0.1"
               sourcetemplate="forward.message"
               sourceport.start="514"
               sourceport.end="1517"
               port="25224"
               )
	} 
}

# omsagent.local - Write OMSAGENT messages to disk
ruleset(name="omsagent.local"
        queue.type="fixedarray"
        queue.filename="omsagent_local"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {

# If event is CEF or ASA, log to omsagent-cef
# Otherwise, log to omsagent-syslog
	if ($rawmsg contains "CEF:" or $rawmsg contains "ASA-")
	 then {
          action(name="write"
               type="omfile"
               dynafile="omsagent-cef.file"
# Will use the builtin:omfile which uses TraditionalFwdWithIP template instead
#               template="omsagent.message"
               iobuffersize="64k"
               flushontxend="off"
               asyncwriting="on"
          )
	}              
	else {
          action(name="write"
               type="omfile"
               dynafile="omsagent-syslog.file"
# Will use the builtin:omfile which uses TraditionalFwdWithIP template instead
#               template="omsagent.message"
               iobuffersize="64k"
               flushontxend="off"
               asyncwriting="on"
          )
	}
}

# Write Syslog messages to disk
ruleset(name="syslog.local"
        queue.type="fixedarray"
        queue.filename="syslog_local"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {
    
        action(name="write" 
               type="omfile" 
               dynafile="syslog.file"  
               iobuffersize="64k" 
               flushontxend="off"
               asyncwriting="on"
              )
}

# unfiltered.local - any messages that come in, but are not caught by any
# of the filter conditions will be logged here
# Not being used but is here in case it is needed for some debugging
ruleset(name="unfiltered.local"
        queue.type="fixedarray"
        queue.filename="unfiltered_local"
        queue.maxdiskspace="1g"
        queue.saveonshutdown="on"
       ) {

        action(name="write"
               type="omfile"
               dynafile="unfiltered.file"
# Will use the builtin:omfile which uses TraditionalFwdWithIP template instead
#               template="unfiltered.message"
               iobuffersize="64k"
               flushontxend="off"
               asyncwriting="on"
              )
}
 
