On 09/06/2012 11:59 PM, [email protected] wrote:
> On Thu, 6 Sep 2012, Boyles, Gary P wrote:
>
>> Hi,
>>
>> I'm new to SEC and have one problem I'm hoping can be solved within SEC.
>>
>> I want to load a (hash) table on SEC startup that contains the host
>> (e.g. foobar.x.y.com) as the key, and a value such as location (e.g.
>> site.building.room.row.rack).
>>
>> So... for 100 hosts I'd have a hash-array where I access the location
>> of each host, and then use that for additional processing.
>>
>> I'd like to be able to load this table on startup, and then use it for
>> all my events (for given patterns).
>>
>> Possibly via a context expression/mini-program???
>>
>> I assume this could be setup with an SEC_STARTUP event, but a
>> real-life example would be most helpful.
>
> Here's what I have on one of my servers, it loads a list of known IP
> addresses into a hash and has an option to reload the table without
> needing a restart
>
> the input is a file
> category|ip
>
> I then have other rules that check to see if an admin login is from an
> unexpected IP address and alert on it.
>
> type=Single
> desc=Load known admin IPs on startup
> ptype=RegExp continue=TakeNext
> pattern=(SEC_STARTUP|SEC_RESTART) context=[SEC_INTERNAL_EVENT]
> action=eval %a ( open(FILE, "</etc/sec/known_admin_ips.txt");\
> while (<FILE>) { chomp; @junk=split;
> $known_admin_ips{$junk[0]}{$junk[1]} = 1}; close(FILE) )
>
> type=Single desc=reload known IPs
> ptype=SubStr
> continue=TakeNext
> pattern=reload known IP addresses
> action=eval %a ( %known_admin_ips=(); open(FILE,
> "</etc/sec/known_admin_ips.txt"); \
> while (<FILE>) { chomp; @junk=split('|',$_);
> $known_admin_ips{$junk[0]}{$junk[1]} = 1; }; close(FILE))
>
I'd like to point out that there is one caveat in the 'eval' action.
Since all match variables and action list variables are replaced with
their values in Perl code that the 'eval' action executes, the variables
need escaping. For example, if there is a regular expression match in
Perl code and the $1 variable is used after it, $1 needs to be escaped
as $$1 (otherwise it would be replaced by match value from rule
pattern). For the same reason, the statement %known_admin_ips=() should
be written as %%known_admin_ips=(), since otherwise %known_admin_ips
would be regarded as an action list variable.
In order to make things easier, you could use 'lcall' action. In the
case of 'lcall', Perl code is compiled once at SEC startup and there is
no substitution of variables in the code during runtime. However, since
'lcall' expects its Perl code to be a valid function definition, any
variable data can be passed to this function as input parameter(s).
In order to provide a suggestion of my own for location table
implementation, here is an example which is similar to David's ruleset.
However, I've added a Calendar rule which checks once a minute if the
location table file has been modified (that's done with the stat() call
in the context expression), and reloads the table from disk into memory
if necessary. The location file modification timestamp is stored in the
global variable $mtime which is used in several rules for checking if
the file has changed. There are also two rules for testing purposes --
one of the prints out the entire location table if it sees input event
'test', and the other one outputs the location of one particular host if
the event 'location hostname' has been observed:
type=Single
ptype=RegExp
pattern=(SEC_STARTUP|SEC_RESTART|SEC_SOFTRESTART)
context=[SEC_INTERNAL_EVENT]
desc=Load the locations file
action=lcall %o -> ( sub { %locations = (); \
if (!open(FILE, "locations.txt")) { return; } \
while (<FILE>) { my(@f) = split(); $locations{$f[0]} = $f[1]; } \
close(FILE); $mtime = (stat("locations.txt"))[9]; } )
type=Calendar
time=* * * * *
desc=The locations file has changed, reloading
context= -> ( sub { my($temp) = (stat("locations.txt"))[9]; \
return defined($temp) && (!defined($mtime) || $mtime !=
$temp); } )
action=lcall %o -> ( sub { %locations = (); \
if (!open(FILE, "locations.txt")) { return; } \
while (<FILE>) { my(@f) = split(); $locations{$f[0]} = $f[1]; } \
close(FILE); $mtime = (stat("locations.txt"))[9]; } )
type=Single
ptype=SubStr
pattern=test
desc=print the content of locations table
action=lcall %o -> ( sub { foreach $ip (keys %locations) { \
print $ip, " ", $locations{$ip}, "\n"; } } )
type=Single
ptype=RegExp
pattern=location (\w+)
desc=print the content of locations table
action=lcall %loc $1 -> ( sub { if (exists($locations{$_[0]})) { \
return $locations{$_[0]}; } else { return "Unknown"; } } ); \
logonly Location for host $1 is %loc
with kind regards,
risto
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
