I had a look into your logs and to me the EventGroup2 rule is working exactly it is supposed to. First, the rule will match the following event:
Dec 16 23:04:53 ubuntu apache-errors: [Mon Dec 16 23:04:50 2013] [error] [client 192.168.0.119] ModSecurity: Warning. Pattern match "(?i:([\\\\s'\\"`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98\\\\(\\\\)]*)?([\\\\d\\\\w]+)([\\\\s'\\"`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98\\\\(\\\\)]*)?(?:=|<=>|r?like|sounds\\\\s+like|regexp)([\\\\s'\\"`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98\\\\(\\\\)]*)?\\\\2|([\\\\s'\\"`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98\\ ..." at ARGS:name. [file "/etc/modsecurity/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "77"] [id "950901"] [rev "2.2.5"] [msg "SQL Injection Attack"] [data "script>alert"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "192.168.0.112"] [uri "/dvwa/vulnerabilities/xss_r/"] [unique_id "Uq-3kn8AAQEAAANQBJ8AAAAE"] After seeing this event, the rule starts an event correlation operation for the client 192.168.0.119 and uniqueID Uq-3kn8AAQEAAANQBJ8AAAAE, with the lifetime of the operation being 60 seconds. The rule will then match further SQL events for the same client and unique ID, and they will therefore be all correlated by the previously started operation. Finally, the rule will match an XSS event for client 192.168.0.119 and uniqueID Uq-3kn8AAQEAAANQBJ8AAAAE, which will also handled by the operation. At this point, the operation has seen at least 1 instance of both events (described by pattern and pattern2) which will trigger the execution of the rule action. After this, the rule will continue running for the remainder of the 60 second correlation window, terminating at 23:05:53. During this time frame, any further events are silently consumed by the operation, without triggering any action. A similar event processing flow will take place at 23:11:43. This is the reason why you are seeing only two "High probability XSS attacks" events in the log. (Also, it seems to me that your clocks are not very well synchronized across systems, because at some points in time simultaneous events at different systems are more than 2 minutes apart by their timestamps.) It seems to me that you have somehow misunderstood how EventGroup rule operates. Have you looked into its documentation at http://simple-evcorr.sourceforge.net/man.html#lbAR ? This section of the docs contains an example how EventGroup rule can reset the counting process immediately after triggering the action. If this is what you want to do, I'd recommend to have a look into this example. regards, risto ------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
