rendered paste body<!-- @(#) $Id: decoder.xml,v 1.118 2007/07/19 23:48:18 dcid Exp $
- OSSEC log decoder.
- Author: Daniel B. Cid
- License: http://www.ossec.net/en/licensing.html
-->
<!--
- Allowed fields:
- location - where the log came from (only on FTS)
- user - extract the user name
- dstuser - the destination username (from su)
- srcip - source ip
- dstip - dst ip
- srcport - source port
- dstport - destination port
- protocol - protocol
- id - event id
- url - url of the event
- action - event action (deny, drop, accept, etc)
- status - event status (success, failure, etc)
- extra_data - Any extra data
-->
<!-- Pam decoder.
- Will extract username and srcip whenever is possible.
- Examples:
- su(pam_unix)[23164]: authentication failure; logname= uid=1342 euid=0 tty= ruser=dcid rhost= user=osaudit
- su(pam_unix)[2298]: authentication failure; logname= uid=1342 euid=0 tty= ruser=dcid rhost= user=root
- vsftpd(pam_unix)[25073]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=211.100.27.101
- vsftpd(pam_unix)[25073]: check pass; user unknown
- sshd(pam_unix)[16660]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=202.110.184.100 user=root
- su(pam_unix)[14592]: session opened for user news by (uid=0)
- su(pam_unix)[14592]: session closed for user news
- sshd(pam_unix)[13025]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.70.129.207 user=nobody
- sshd(pam_unix)[18987]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=languedoc-2-81-56-82-49.fbx.proxad.net user=root
- sshd(pam_unix)[17365]: session opened for user test by (uid=508)
- sshd(pam_unix)[1345]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=222.237.79.237 user=root
- sshd(pam_unix)[15794]: 2 more authentication failures; logname= uid=0
euid=0 tty=ssh ruser= rhost=10.0.3.1 user=root
- Nov 17 21:41:22 localhost su[8060]: (pam_unix) session opened for user root by (uid=0)
- Nov 11 22:46:29 localhost vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=1.2.3.4
-->
<decoder name="pam">
<program_name>(pam_unix)$</program_name>
</decoder>
<decoder name="pam">
<program_name>^vsftpd</program_name>
<prematch>^pam_unix</prematch>
</decoder>
<decoder name="pam-host-user">
<parent>pam</parent>
<prematch>rhost=\S+\s+user=\S+</prematch>
<regex>rhost=(\S+)\s+user=(\S+)</regex>
<order>srcip, user</order>
</decoder>
<decoder name="pam-user">
<parent>pam</parent>
<prematch>session opened </prematch>
<regex offset="after_prematch">^for user (\S+) </regex>
<order>user</order>
</decoder>
<decoder name="pam-host">
<parent>pam</parent>
<prematch> rhost</prematch>
<regex offset="after_prematch">^=(\S+)</regex>
<order>srcip</order>
</decoder>
<!-- SSH decoder.
- Will extract username and srcip from the logs.
- Only add to the FTS if the login was sucessfull
- If the login failed, just extract the username/srcip for correlation
- Examples:
- sshd[8813]: Accepted password for root from 192.168.10.1 port 1066 ssh2
- sshd[2404]: Accepted password for root from 192.168.11.1 port 2011 ssh2
- sshd[21405]: Accepted password for root from 192.1.1.1 port 6023 ssh2
- sshd[21487]: Failed password for root from 192.168.1.1 port 1045 ssh2
- sshd[8813]: Failed none for root from 192.168.10.161 port 1066 ssh2
- sshd[12675]: Failed password for invalid user lala11 from x.x.x.x ..
- sshd[12914]: Failed password for invalid user lala6 from ...
- sshd[8267]: Failed password for illegal user test from 62.67.45.4 port 39141 ssh2
- sshd[11259]: Invalid user abc from 127.0.0.1
- "" Failed keyboard-interactive for root from 192.1.1.1 port 1066 ssh2
- sshd[23857]: [ID 702911 auth.notice] User xxx, coming from zzzz,
- authenticated.
- sshd[23578]: reverse mapping checking getaddrinfo for pib4.catv-bauer.at failed - POSSIBLE BREAKIN ATTEMPT!
- sshd[61834]: reverse mapping checking getaddrinfo for sv.tvcm.ch
- failed - POSSIBLE BREAKIN ATTEMPT!
- sshd[3251]: User root not allowed because listed in DenyUsers
- [Time 2006.12.28 15:53:55 UTC] [Facility auth] [Sender sshd] [PID 483] [Message error: PAM: Authentication failure for username from 192.168.0.2] [Level 3] [UID -2] [GID -2] [Host Hostname]
- [Time 2006.11.02 11:41:44 UTC] [Facility auth] [Sender sshd] [PID 800] [Message refused connect from 51.124.44.34] [Level 4] [UID -2] [GID -2] [Host test2-emac]
- Apr 23 07:03:53 machinename sshd[29961]: User root from 12.3.4.5
not allowed because not listed in AllowUsers
-->
<decoder name="sshd">
<program_name>^sshd</program_name>
</decoder>
<decoder name="sshd-success">
<parent>sshd</parent>
<prematch>^Accepted</prematch>
<regex offset="after_prematch">^ \S+ for (\S+) from (\S+) port </regex>
<order>user, srcip</order>
<fts>name, user, location</fts>
</decoder>
<decoder name="ssh-denied">
<parent>sshd</parent>
<prematch>^User \S+ from </prematch>
<regex offset="after_parent">^User (\S+) from (\S+) </regex>
<order>user, srcip</order>
</decoder>
<decoder name="sshd-success-solaris">
<parent>sshd</parent>
<prematch>^User </prematch>
<regex offset="after_prematch">^(\S+), comming from (\S+), auth</regex>
<order>user, srcip</order>
<fts>name, user, location</fts>
</decoder>
<decoder name="ssh-invfailed">
<parent>sshd</parent>
<prematch>^Failed \S+ for invalid user|^Failed \S+ for illegal user</prematch>
<regex offset="after_prematch">from (\S+) port \d+ \w+$</regex>
<order>srcip</order>
</decoder>
<decoder name="ssh-failed">
<parent>sshd</parent>
<prematch>^Failed \S+ </prematch>
<regex offset="after_prematch">^for (\S+) from (\S+) port \d+ \w+$</regex>
<order>user, srcip</order>
</decoder>
<decoder name="ssh-error">
<parent>sshd</parent>
<prematch>^error: PAM: Authentication </prematch>
<regex offset="after_prematch">^failure for (\S+) from (\S+)$</regex>
<order>user, srcip</order>
</decoder>
<decoder name="ssh-reverse-mapping">
<parent>sshd</parent>
<prematch>^reverse mapping checking </prematch>
<regex offset="after_prematch">^\w+ for (\S+) failed - </regex>
<order>srcip</order>
</decoder>
<decoder name="ssh-invalid-user">
<parent>sshd</parent>
<prematch>^Invalid user|^Illegal user</prematch>
<regex offset="after_prematch"> from (\S+)$</regex>
<order>srcip</order>
</decoder>
<decoder name="ssh-generic">
<parent>sshd</parent>
<regex> from (\S+)$</regex>
<order>srcip</order>
</decoder>
<!--
- Telnet decoder
- Will extract the srcip
- Examples:
- May 31 12:33:44 queen telnetd[9876]: warning: can't verify hostname:
gethostbyname(131.1.satis-tl.ru) failed
- May 29 21:12:18 queen telnetd[6474]: refused connect from 81.215.42.27
- Jun 1 23:02:07 queen telnetd[62948]: connect from external.example.net
- Jun 1 23:02:07 queen telnetd[62948]: ttloop: read: A connection with a remote socket was reset by that socket.
- Jun 2 09:54:28 valhalla in.telnetd[19723]: [ID 927837 local2.info] connect from external.example.net
- Jun 2 09:54:28 valhalla telnetd[19723]: [ID 485252 daemon.info] ttloop: peer died: Error 0
-->
<decoder name="telnetd">
<program_name>^telnetd|^in.telnetd</program_name>
</decoder>
<decoder name="telnetd-ip">
<parent>telnetd</parent>
<regex>from (\d+.\d+.\d+.\d+)$</regex>
<order>srcip</order>
</decoder>
<!--
- Samba decoder.
- Will extraxt the username/srcip
- Examples:
- smbd[832]: Denied connection from (192.168.3.23)
- smbd[832]: Connection denied from 0.0.0.0
- smbd[17535]: Permission denied\-\- user not allowed to delete,
pause, or resume print job. User name: ahmet. Printer name: prnq1.
-->
<decoder name="smbd">
<program_name>^smbd</program_name>
</decoder>
<decoder name="smbd-user">
<parent>smbd</parent>
<prematch>User name:</prematch>
<regex offset="after_prematch">^ (\S+).</regex>
<order>user</order>
</decoder>
<decoder name="smbd-ip">
<parent>smbd</parent>
<regex> from \((\d+.\d+.\d+.\d+)\)</regex>
<order>srcip</order>
</decoder>
<!-- Sudo decoder.
- Will extract the username
- Examples:
- Apr 27 15:22:23 niban sudo: dcid : TTY=pts/4 ; PWD=/home/dcid ; USER=root ; COMMAND=/usr/bin/tail /var/log/snort/alert.fast
- Apr 27 15:25:08 niban sudo: dcid : TTY=pts/4 ; PWD=/home/dcid ; USER=root ; COMMAND=/usr/bin/tail /var/log/snort/alert.fast
- Apr 14 10:59:01 enigma sudo: dcid : TTY=ttyp3 ; PWD=/home/dcid/ossec-hids.0.1a/src/analysisd ; USER=root ; COMMAND=/bin/cp -pr ../../bin/addagent ../../bin/osaudit-logaudit ../../bin/ossec-execd ../../bin/ossec-logcollector ../../bin/ossec-maild ../../bin/ossec-remoted /var/ossec/bin
- Apr 19 14:52:02 enigma sudo: dcid : TTY=ttyp3 ; PWD=/var/www/alex ; USER=root ; COMMAND=/sbin/chown dcid.dcid .
-->
<decoder name="sudo">
<program_name>^sudo</program_name>
<regex>^\s+(\S+)\s:</regex>
<order>user</order>
<fts>name,user,location</fts>
<ftscomment>First time user executed the sudo command</ftscomment>
</decoder>
<!-- Su decoder.
- Will extract the username.
- Examples:
- su[2921936]: failed: ttyq4 changing from ldap to root
- su[234]: BAD SU ger to fwmaster on /dev/ttyp0
- su(pam_unix)[23164]: authentication failure; logname= uid=1342 euid=0 tty= ruser=dcid rhost= user=osaudit
- su(pam_unix)[2298]: authentication failure; logname= uid=1342 euid=0 tty= ruser=dcid rhost= user=root
- Jul 5 12:17:38 lili su[2702]: - pts/5 ab-dc-root
- Jul 5 12:13:15 lili su[2614]: - pts/6 dcid-root
- su[29149]: + pts/5 dcid:root
- SU 07/23 01:24 + pts/4 lcid-root
- Apr 22 17:51:51 enigma su: dcid to root on /dev/ttyp1
-->
<decoder name="su">
<program_name>^su$</program_name>
<regex>^BAD SU (\S+) to (\S+) on|</regex>
<regex>^failed: \S+ changing from (\S+) to (\S+)|</regex>
<regex>^\S \S+ (\S+)\p(\S+)$|^(\S+) to (\S+) on </regex>
<order>user, dstuser</order>
<fts>name, user, location</fts>
</decoder>
<decoder name="su">
<prematch>^SU \S+ \S+ </prematch>
<regex offset="after_prematch">^\S \S+ (\S+)-(\S+)$</regex>
<order>user, dstuser</order>
<fts>name, user, location</fts>
</decoder>
<!-- ProFTPD decoder.
- Will extract the username/srcip
- Examples:
- proftpd[26916]: hayaletgemi (85.101.218.135[85.101.218.135]) - ANON anonymous: Login successful.
- proftpd[12564]: juf01 (pD9EE35B1.dip.t-dialin.net[217.238.53.177]) - USER jufu: Login successful
- proftpd[30362] xx.yy.zz (aa.bb.cc[aa.bb.vv.dd]): USER backup: Login successful.
- proftpd[2344]: refused connect from 192.168.1.2 (192.168.1.2)
- proftpd[15181]: valhalla (crawl-66-249-66-80.googlebot.com[66.249.66.80]) - Connection from crawl-66-249-66-80.googlebot.com [66.249.66.80] denied.
-->
<decoder name="proftpd">
<program_name>^proftpd</program_name>
</decoder>
<decoder name="proftpd-success">
<parent>proftpd</parent>
<prematch>: Login successful</prematch>
<regex>^\S+ \(\S+[(\S+)]\)\s*\S \w+ (\S+): </regex>
<regex>Login successful</regex>
<order>srcip, user</order>
<fts>name, user, srcip, location</fts>
</decoder>
<decoder name="proftpd-ip">
<parent>proftpd</parent>
<regex>^\S+ \(\S+[(\S+)]\)</regex>
<order>srcip</order>
</decoder>
<!-- Pure-FTPd decoder.
- Will extract the username/srcip whenever possible.
- Samples by Peter Ahlert <peter@ifup.de> (thanks!)
- Examples:
- pure-ftpd-wrapper[926]: connect from 1.1.0.1 (1.1.0.1)
- pure-ftpd: (?@1.1.0.1) [INFO] New connection from 1.1.0.1
- pure-ftpd: (abcde@1.1.0.1) [INFO] Can't change directory to /.test: Permission denied
- pure-ftpd: (abcde@1.1.0.1) [INFO] Logout.
- pure-ftpd: (?@59.150.14.54) [WARNING] Authentication failed for user [newuser]
-->
<decoder name="pure-ftpd">
<program_name>^pure-ftpd</program_name>
</decoder>
<decoder name="pure-ftpd-login">
<parent>pure-ftpd</parent>
<prematch>^\S+ [INFO] \S+ is now logged in</prematch>
<regex>^\(?@(\S+)\) [INFO] (\S+) is now logged in</regex>
<order>srcip, user</order>
<fts>name, user, srcip, location</fts>
</decoder>
<decoder name="pure-ftpd-generic">
<parent>pure-ftpd</parent>
<regex>^\((\S+)@(\S+)\) [</regex>
<order>user,srcip</order>
</decoder>
<!-- vsftpd decoder.
- Will extract the srcip.
- Examples:
- Sun Jun 4 22:08:04 2006 [pid 21612] CONNECT: Client "192.168.2.10"
- Sun Jun 4 22:08:39 2006 [pid 21611] [dcid] OK LOGIN: Client "192.168.2.10"
- Sun Jun 4 22:09:22 2006 [pid 21622] CONNECT: Client "192.168.2.10"
- Sun Jun 4 22:09:24 2006 [pid 21621] [lalal] FAIL LOGIN: Client "192.168.2.10"
- Sat Jun 3 07:51:42 2006 [pid 25073] [Administrator] FAIL LOGIN: Client
"211.100.27.101"
- Sun Aug 27 16:28:20 2006 [pid 13962] [xx] OK UPLOAD: Client "1.2.3.4", "/a.php", 8338 bytes, 18.77Kbyte/sec
-->
<decoder name="vsftpd">
<prematch>^\w\w\w \w\w\w\s+\d+ \S+ \d+ [pid \d+] </prematch>
<regex offset="after_prematch">Client "(\d+.\d+.\d+.\d+)"$</regex>
<order>srcip</order>
</decoder>
<!-- FTPD decoder (Solaris).
- Examples:
- ftpd[811166]: refused connect from 88.225.42.182
- in.ftpd[18561]: [ID 484914 daemon.notice] gethostbyaddr: nameservices.net. != 216.117.134.168
- ftpd[31918]: FTPD: EXPORT file local , remote
-->
<decoder name="ftpd">
<program_name>^ftpd|^in.ftpd</program_name>
</decoder>
<decoder name="ftpd-ip">
<parent>ftpd</parent>
<regex>from (\d+.\d+.\d+.\d+)$</regex>
<order>srcip</order>
</decoder>
<!-- Arpwatch decoder.
- Will extract srcip/mac for "new station" messages.
- Examples:
- arpwatch: new station 192.168.1.103 0:11:43:5e:5d:80 eth0
- arpwatch: bogon 172.16.150.149 0:2:b3:d6:e5:68 eth0
- arpwatch: new station 192.168.2.10 0:c0:4f:78:32:be
-->
<decoder name="arpwatch">
<program_name>^arpwatch</program_name>
</decoder>
<decoder name="arpwatch-new">
<parent>arpwatch</parent>
<prematch>^new station |^bogon </prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+) (\S+)</regex>
<order>srcip, extra_data</order>
<fts>name, srcip, extra_data</fts>
</decoder>
<!-- Imapd decoder.
- Will extract the username/srcip
- Examples:
- imapd[26888]: Login failed user=babadosfashion auth=babadosfashion host=bahiana.resenet.com.br [200.255.5.8]
- imapd[21040]: Login failed user=root domain=(null) auth=root host=host29-141.poo
l8249.interbusiness.it [82.49.141.29]
- imapd[27113]: Authenticated user=badyy host=a.resenet.com.br [1.2.3.4]
- imapd[27113]: Logout user=badyy host=a.resenet.com.br [1.2.3.4]
-->
<decoder name="imapd">
<program_name>^imapd</program_name>
<regex offset="after_prematch">user=(\S+) \.+ [(\d+.\d+.\d+.\d+)]$</regex>
<order>user,srcip</order>
</decoder>
<!-- Vpopmail decoder. (by Ceg Ryan <cegryan ( at ) gmail.com>)
- Examples:
- vpopmail[32485]: vchkpw-pop3: password fail abc@xxx.com:x.x.x.x
- vpopmail[32485]: vchkpw-2110 password fail abc@xxx.com:x.x.x.x
- vpopmail[2100]: vchkpw-pop3: vpopmail user not found abc@xxx.com:x.x.x.x
-->
<decoder name="vpopmail">
<program_name>^vpopmail</program_name>
</decoder>
<decoder name="vpopmail-fail">
<parent>vpopmail</parent>
<prematch>^vchkpw-pop3: password fail</prematch>
<regex offset="after_prematch">^ (\S+)@\S+:(\d+.\d+.\d+.\d+)$</regex>
<order>user, srcip</order>
</decoder>
<decoder name="vpopmail-notfound">
<parent>vpopmail</parent>
<prematch>^vchkpw-pop3: vpopmail user not </prematch>
<regex offset="after_prematch">^found (\S+)@\S+:(\d+.\d+.\d+.\d+)$</regex>
<order>user, srcip</order>
</decoder>
<!-- Courier decoder
- Examples:
- pop3d-ssl: LOGIN FAILED, ip=[::ffff:192.168.0.200]
- courierpop3login: LOGIN, user=web10_mauricio, ip=[::ffff:192.168.0.100]
- courierpop3login: LOGIN FAILED, ip=[::ffff:192.168.0.188]
- imaplogin: DISCONNECTED, ip=[::ffff:127.0.0.1], time=0
-->
<decoder name="courier">
<program_name>^pop3d-ssl|^courierpop3login|^imaplogin</program_name>
</decoder>
<decoder name="courier-login">
<parent>courier</parent>
<prematch>^LOGIN, </prematch>
<regex offset="after_prematch">^user=(\S+), ip=[(\S+\d)]$</regex>
<order>user, srcip</order>
</decoder>
<decoder name="courier-generic">
<parent>courier</parent>
<regex>, ip=[(\S+\d)]$</regex>
<order>srcip</order>
</decoder>
<!-- Named decoder.
- Will extract the srcip
- Examples:
- valhalla named[7885]: client 192.168.1.231#1142: update 'hayaletgemi.edu/IN' denied
- named[12637]: client 1.2.3.4#32769: query (cache) 'somedomain.com/MX/IN' denied
-->
<decoder name="named">
<program_name>^named</program_name>
</decoder>
<decoder name="named_client">
<parent>named</parent>
<prematch>^client </prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+)#</regex>
<order>srcip</order>
</decoder>
<decoder name="named_from">
<parent>named</parent>
<regex offset="after_parent"> from [(\d+.\d+.\d+.\d+)]</regex>
<order>srcip</order>
</decoder>
<!-- Postfix decoder.
- Will extract the srcip
- Examples:
- postfix/smtpd[32297]: NOQUEUE: reject: RCPT from unknown[213.255.237.245]: 554
<ce101@ce.metu.edu.tr>: Relay access denied; from=<kryonomm@yahoo.com>
to=<e10445@jubiipost.dk> proto=SMTP helo=<SM01.net>
-->
<decoder name="postfix">
<program_name>^postfix</program_name>
</decoder>
<decoder name="postfix-reject">
<use_own_name>true</use_own_name>
<parent>postfix</parent>
<prematch>^NOQUEUE: reject: RCPT from </prematch>
<regex offset="after_prematch">[(\d+.\d+.\d+.\d+)]: (\d+) </regex>
<order>srcip,id</order>
</decoder>
<!-- Sendmail decoder.
- Will extract the srcip
- Examples:
- sendmail[15806618]: k1SN9pkK15806618: ruleset=check_mail, arg1=<rtreter@qffff.com>,
- relay=dsl.static81215198185.ttnet.net.tr [81.215.198.185] (may be forged), reject=553 5.1.8
- <rtreter@qffff.com>... Domain of sender address rtreter@qffff.com does not exist
- sm-msp-queue[13484]: k5TKj6L5012934: to=root, ctladdr=root (0/0), delay=00:04:00, xdelay=00:00:00, mailer=relay, pri=120112, relay=[127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
- sendmail[7735]: [ID 801593 mail.notice] k856Hah0007735: ruleset=check_rcpt, arg1=<sc@sd.com>, relay=[216.22.33.7], reject=553 5.3.0 <sc@sd.com>... Spammer 216.22.33.7 usergl@displaytoward.net rejected by RBL:http://www.spamhaus.org/
- sm-mta[23868]: k9BEQK0c023868: rejecting commands
from [200.121.73.169] [200.121.73.169] due to pre-greeting traffic
- sendmail[7818]: j6KKHo2d007818: rejecting commands from sv.e103gng.com [66.62.19.10] due to pre-greeting traffic
-->
<decoder name="sendmail-reject">
<program_name>^sendmail|^sm-mta|^sm-msp-queue</program_name>
</decoder>
<decoder name="sendmail-pre-greeting">
<parent>sendmail-reject</parent>
<prematch>^\S+: rejecting commands from</prematch>
<regex offset="after_prematch">^ \S+ [(\d+.\d+.\d+.\d+)]</regex>
<order>srcip</order>
</decoder>
<decoder name="sendmail-reject-nodns">
<parent>sendmail-reject</parent>
<prematch>relay=[</prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+)]</regex>
<order>srcip</order>
</decoder>
<decoder name="sendmail-reject-dns">
<parent>sendmail-reject</parent>
<prematch>relay=\S+ [</prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+)]</regex>
<order>srcip</order>
</decoder>
<!-- SMF-SAV Sendmail Milter decoder.
- Will extract the srcip
- Examples:
- smf-sav[513]: [ID 987462 mail.notice] sender check failed: <xkyjywqvophshu@mypersonalemail.com>, 125.133.22.112, [125.133.22.112], [00:00:01]
- smf-sav[513]: [ID 407019 mail.info] sender check succeeded (cached): <asterisk-users-bounces@lists.digium.com>, 216.207.245.17, lists.digium.com
- smf-sav[513]: [ID 987894 mail.notice] sender check tempfailed: <31363****-org@targetedpages.com>, 69.8.190.101, smtp101.tramailer.info, [00:00:05]
-->
<decoder name="smf-sav-reject">
<program_name>^smf-sav</program_name>
<prematch>sender check failed: \S+, </prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+),</regex>
<order>srcip</order>
</decoder>
<!-- Mail scanner
- Will extract the srcip/action
- Examples:
- MailScanner[24112]: Message k7B9Mc6b015925 from
68.171.145.34 (nilsenator@hotmail.com) to yyyyy.no is spam, SpamAssassin
- May 3 16:28:40 jarjar MailScanner[4732]: Message k436SX2M005191 from
111.222.111.222 (david@our.domain.org) to our.domain.org is spam
, SpamAssassin
- MailScanner[5317]: Message k436dCIW005370 from
111.222.111.222 (david@our.domain.org) to another.domain.org is not s
pam, SpamAssassin
- MailScanner[29107]: Message j0EMandY027564 from xxx.xxx.xxx.xxx(xxxxx@xxxxx.ie) to xxxxx.ie is not spam
-->
<decoder name="mailscanner">
<program_name>^MailScanner</program_name>
</decoder>
<decoder name="mailscanner-ip">
<parent>mailscanner</parent>
<prematch>^Message \S+ from </prematch>
<regex offset="after_prematch">^(\d+.\d+.\d+.\d+) \S+ to \S+ is (\w+)</regex>
<order>srcip, action</order>
</decoder>
<!-- Iptables decoder.
- Will extract the srcip, dstip, srcport, dstport, protocol
- Examples:
- kernel: FIREWALL_OUT IN= OUT=eth0
SRC=192.168.6.57 DST=216.161.248.225 LEN=40 TOS=0x00 PREC=0x00 TTL=64
ID=18547 DF PROTO=TCP SPT=46388 DPT=37628 WINDOW=6930 RES=0x00 ACK RST
URGn=0
- kernel: IPTABLE IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:03:93:db:2e:b4:08:00
SRC=10.4.11.40 DST=255.255.255.255 LEN=180 TOS=0x00 PREC=0x00 TTL=64
ID=4753 PROTO=UDP SPT=49320 DPT=2222 LEN=160
- kernel: [4475569.016000] IN= OUT=lo SRC=192.168.2.11 DST=192.168.2.11
LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=49546 DF PROTO=TCP SPT=43068
DPT=22 WINDOW=8192 RES=0x00 ACK URGP=0
- Aug 17 10:03:37 myhostname kernel: SFW2-INext-DROP-DEFLT IN=eth0 OUT= MAC=00:08:02:da:c8:51:00:0f:f7:74:31:8a:08:00 SRC=1.2.3.36 DST=1.2.3.194 LEN=28 TOS=0x00 PREC=0x00 TTL=44 ID=60200 PROTO=ICMP TYPE=8 CODE=0 ID=10466 SEQ=21229
-->
<decoder name="iptables">
<program_name>^kernel</program_name>
</decoder>
<decoder name="iptables-1">
<parent>iptables</parent>
<type>firewall</type>
<prematch>^[\d+.\d+] \S+ IN=</prematch>
<regex>^[\d+.\d+] (\S+) \.+ SRC=(\S+) DST=(\S+)</regex>
<regex> \.+ PROTO=(\w+) </regex>
<order>action,srcip,dstip,protocol</order>
</decoder>
<decoder name="iptables-1">
<parent>iptables</parent>
<type>firewall</type>
<regex offset="after_regex">^SPT=(\d+) DPT=(\d+) </regex>
<order>srcport,dstport</order>
</decoder>
<decoder name="iptables-2">
<parent>iptables</parent>
<type>firewall</type>
<prematch>^\S+ IN=</prematch>
<regex>^(\S+) \.+ SRC=(\S+) DST=(\S+) \.+ </regex>
<regex>PROTO=(\w+) </regex>
<order>action,srcip,dstip,protocol</order>
</decoder>
<decoder name="iptables-2">
<parent>iptables</parent>
<type>firewall</type>
<regex offset="after_regex">^SPT=(\d+) DPT=(\d+) </regex>
<order>srcport,dstport</order>
</decoder>
<!-- Solaris IPFilter decoder.
- Will extract the action, srcip, srcport, dstip, dstport
- Examples:
- ipmon[11523]: [ID 702911 local0.warning] 09:30:39.300795 3x ce0 @0:1
b 10.4.0.25,43873 -> 10.4.122.243,22 PR tcp len 20 100 -AP IN
- ipmon[11523]: [ID 702911 local0.warning] 09:31:53.285032 hme0 @0:1
b 10.4.122.243,138 -> 255.255.255.255,138 PR udp len 20 229 IN mbcast
- ipmon[11523]: [ID 702911 local0.notice] 09:30:40.398290 ce0 @0:14
p 10.4.122.243,123 -> 10.4.122.16,123 PR udp len 20 76 K-S OUT
-->
<decoder name="ipfilter">
<type>firewall</type>
<program_name>^ipmon</program_name>
<regex> (\w) (\d+.\d+.\d+.\d+),(\d+) -> </regex>
<regex>(\d+.\d+.\d+.\d+),(\d+) PR (\w+) </regex>
<order>action,srcip,srcport,dstip,dstport,protocol</order>
</decoder>
<!-- AIX IPSec decoder.
- Will extract the action,srcip,dstip,protocol,srcport,dstport
- Examples:
- ipsec_logd: #:3 R:p I:10.0.0.99 S:10.0.0.82 D:10.0.0.99
P:tcp/ack SP:50349 DP:22 R:l I:en0 F:n T:0 L:88
- ipsec_logd: #:1 R:p O:10.0.0.99. S:10.0.0.99 D:10.0.0.25
P:udp SP:2063 DP:53 R:l I:en0 F:n T:0 L:81
-->
<decoder name="aix-ipsec">
<type>firewall</type>
<program_name>^ipsec_logd</program_name>
<regex> R:(\w) \w:\S+ S:(\d+.\d+.\d+.\d+) </regex>
<regex>D:(\d+.\d+.\d+.\d+) P:(\S+) SP:(\d+) DP:(\d+) </regex>
<order>action,srcip,dstip,protocol,srcport,dstport</order>
</decoder>
<!-- OpenBSD pf decoder (as a plugin - compiled).
- Will extract the action,srcip,dstip,protocol,srcport,dstport
- Examples:
- Mar 30 15:33:26 enigma pf: Mar 30 15:32:33.483712 rule 2/(match) pass in on xl0: 140.211.166.3.6667 > 192.168.2.10.16290: P 7408:7677(269) ack 1773 win 2520 <nop,nop,timestamp 3960674784 2860123562> (DF)
- Mar 30 15:47:05.522341 rule 4/(match) block in on lo0: 127.0.0.1.48784 > 127.0.0.1.23: S 1381529123:1381529123(0) win 16384 <mss 33184,nop,nop,sackOK,nop,wscale 0,[|tcp]> (DF) [tos 0x10]
- Mar 30 15:54:22.171929 rule 3/(match) pass out on xl0: 192.168.2.10.1514 > 192.168.2.190.1030: udp 73
- Mar 30 15:54:22.174412 rule 3/(match) pass out on xl0: 192.168.2.10.1514 > 192.168.2.190.1030: udp 89
-->
<decoder name="pf">
<type>firewall</type>
<program_name>^pf$</program_name>
<plugin_decoder>PF_Decoder</plugin_decoder>
</decoder>
<!-- SonicWall decoder.
- Will extract action, srcip, dstip, protocol, srcport and dstport
- Examples:
- Jan 3 13:45:36 192.168.5.1 id=firewall sn=000SERIAL time="2007-01-03 14:48:06" fw=1.1.1.1 pri=6 c=262144 m=98 msg="Connection Opened" n=23419 src=2.2.2.2:36701:WAN dst=1.1.1.1:50000:WAN proto=tcp/50000
- Jan 3 13:45:36 192.168.5.1 id=firewall sn=000SERIAL time="2007-01-03 14:48:07" fw=1.1.1.1 pri=1 c=32 m=30 msg="Administrator login denied due to bad credentials" n=7 src=2.2.2.2:36701:WAN dst=1.1.1.1:50000:WAN
- id=firewall sn=00301E0526B1 time="2004-04-01 10:39:35"
fw=67.32.44.2 pri=5 c=64 m=36 msg="TCP connection dropped" n=2686 src=67.101.200.27:4507:WAN dst=67.32.44.2:445:LAN rule=0
-->
<!-- Disabled (need more logs)
<decoder name="sonicwall">
<type>firewall</type>
<prematch>^id=firewall sn=\w+ time=\S+ \S+ fw=\S+ pri=\d c=\d+ </prematch>
<prematch>m=\d+ msg=</prematch>
<regex offset="after_prematch">^"Connection (\w+)" n=\w+ </regex>
<regex>src=(\S+):(\d+):\w+ dst=(\S+):(\d+):\w+</regex>
</decoder>
-->
<!-- Netscreen Firewall decoder.
- Will extract the action,srcip,dstip,protocol,srcport,dstport
- Examples:
- Jan 1 10:02:11 [11.210.1.193.1.132] ns5gt: NetScreen device_id=ns5gt [No Name]system-notification-00257(traffic): start_time="2006-01-01 10:09:38" duration=0 policy_id=310101 service=tcp/port:1526 proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=38 src=10.1.2.3 dst=10.1.1.1 src_port=51350 dst_port=1426
- <13>Mar 16 15:27:56 192.168.2.1 ns5gt: NetScreen device_id=ns5gt [No Name]system-notification-00257(traffic): start_time=\"2004-03-16 16:31:22\" duration=0 policy_id=310001 service=tcp/port:120 proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=60 src=10.1.1.1 dst=10.1.2.1 src_port=32047 dst_port=22
- Jun 2 11:24:16 fire00 sav00: NetScreen device_id=sav00 [Root]system-critical-00436: Large ICMP packet! From 210.232.20.7 to 148.100.114.126, proto 1 (zone Untrust, int ethernet1/2). Occurred 1 times. (2006-06-02 11:24:16)
- NetScreen device_id=ns5gt [Root]system-critical-00027: Multiple login failures occurred for user netscreen from IP address 1.2.3.4:1567 (2004-10-07)
-->
<decoder name="netscreenfw">
<program_name>^sav00|^ns5gt</program_name>
<prematch>^NetScreen device_id</prematch>
</decoder>
<decoder name="netscreenfw-traffic">
<parent>netscreenfw</parent>
<type>firewall</type>
<prematch offset="after_parent">system-notification-00257</prematch>
<prematch>\(traffic\): </prematch>
<regex offset="after_prematch"> proto=(\w+) \.+action=(\w+) </regex>
<regex>\.+src=(\S+) dst=(\S+) src_port=(\d+) dst_port=(\d+)</regex>
<order>protocol, action, srcip, dstip, srcport, dstport</order>
</decoder>
<decoder name="netscreenfw-critical">
<parent>netscreenfw</parent>
<prematch offset="after_parent">system-critical-\.+ from </prematch>
<regex offset="after_parent">system-(\w+)-(\d+): \.+ </regex>
<regex>from\.+(\d+.\d+.\d+.\d+) </regex>
<order>action, id, srcip</order>
</decoder>
<decoder name="netscreenfw-admin">
<parent>netscreenfw</parent>
<regex offset="after_parent">]system-(\w+)-(\d+):</regex>
<order>action, id</order>
</decoder>
<!-- Pix decoder.
- Will extract the srcip, srcport, dstip and dstport whenever possible.
- Examples:
- %PIX-6-106015: Deny TCP (no connection) from 161.58.238.151/110 to a.b.c.d/3782 flags RST ACK
- %PIX-2-106001: Inbound TCP connection denied from 165.139.46.7/3854 to 165.189.27.70/139 flags
- %PIX-3-106010: Deny inbound tcp src outside:213.98.79.233/2620 dst dmz:213.98.254.145/135
- %PIX-3-106011: Deny inbound (No xlate) udp src outside:192.168.2.1/137
dst outside:192.168.2.14/137
- %PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.7.43/80 dst
inside:10.100.4.71/2285
- %PIX-3-710003: TCP access denied by ACL from 216.39.220.130/54065 to outside:62.192.113.98/ssh
- %PIX-7-710001: TCP access requested from X.X.X.X/1292 to outside:Y.Y.Y.Y/ssh
- %PIX-7-710002: UDP access permitted from 33.33.33.4/943 to inside:33.33.33.15/snmp
- %PIX-7-710005: UDP request discarded from <public IP of 525>/4500 to outside:192.168.69.137/4500
- %PIX-2-106002 protocol Connection denied by outbound list acl_ID src inside_address dest outside_address
- %PIX-2-106002: udp connection denied by outbound list 30 src 216.53.120.62 138 dest 169.132.10.82 138
- %PIX-4-106023: Deny tcp src inside:111.11.11.1/2143 dst YYY:172.11.1.11/139 by access-group "inside_inbound"
- %PIX-4-400013 IDS:2003 ICMP redirect from 10.4.1.2 to 10.2.1.1 on interface dmz
- %PIX-2-106006: Deny inbound UDP from ***/20031 to ***/20031 on
interface vpn
- %PIX-7-710002: TCP access permitted from 10.0.0.1/60749 to db:10.0.0.2/ssh
- %PIX-6-305012: Teardown dynamic UDP translation from inside:1.1.1.1/12 to outside:1.2.1.2/11 duration 0:00:11.
- %PIX-3-305005: No translation group found for icmp src outside:x.x.x.x dst inside:x.x.x.x (type 3, code 0)
- %ASA-2-106001: Inbound TCP connection denied from 1.2.3.4/1234 to 213.207.99.248/445 flags SYN on interface outside (Message repeated 2 times)
- %PIX-6-605005: Login permitted from 192.168.1.2/2953 to inside:192.168.1.1/telnet for user ""
- %PIX-6-605004: Login denied from 192.168.2.10/32597 to outside:192.168.2.14/ssh for user "root"
- %PIX-6-305011: Built dynamic UDP translation from inside:192.168.1.2/1026 to outside:192.168.2.14/1163
- %PIX-6-305011: Built dynamic TCP translation from inside:192.168.1.3/54946 to outside:192.168.2.14/1033
- %PIX-6-302015: Built outbound UDP connection 156 for outside:192.168.2.10/1514 (192.168.2.10/1514) to inside:192.168.1.2/1026 (192.168.2.14/1163)
-->
<decoder name="pix">
<prematch>^%PIX-|^\w\w\w \d\d \d\d\d\d \d\d:\d\d:\d\d: %PIX-|</prematch>
<prematch>^%ASA-|^\w\w\w \d\d \d\d\d\d \d\d:\d\d:\d\d: %ASA-|</prematch>
<prematch>^%FWSM-|^\w\w\w \d\d \d\d\d\d \d\d:\d\d:\d\d: %FWSM-</prematch>
</decoder>
<decoder name="pix-fw1">
<parent>pix</parent>
<type>firewall</type>
<prematch offset="after_parent">^2-106001</prematch>
<regex offset="after_parent">^(\S+): \w+ (\w+) \S+ (\S+) from </regex>
<regex>(\S+)/(\S+) to (\S+)/(\S+)</regex>
<order>id, protocol, action, srcip, srcport, dstip, dstport</order>
</decoder>
<decoder name="pix-fw2">
<parent>pix</parent>
<type>firewall</type>
<prematch offset="after_parent">^3-710003|^7-710002|^7-710005</prematch>
<regex offset="after_parent">^(\S+): (\S+) \w+ (\w+)\.+from </regex>
<regex>(\S+)/(\S+) to \w+:(\S+)/(\S+)</regex>
<order>id, protocol, action, srcip, srcport, dstip, dstport</order>
</decoder>
<decoder name="pix-fw3">
<parent>pix</parent>
<type>firewall</type>
<prematch offset="after_parent">^4-106023</prematch>
<regex offset="after_parent">^(\S+): (\w+) (\w+) src \w+:</regex>
<regex>(\S+)/(\S+) dst \w+:(\S+)/(\S+)</regex>
<order>id, action, protocol, srcip, srcport, dstip, dstport</order>
</decoder>
<decoder name="pix-fw4">
<parent>pix</parent>
<type>firewall</type>
<prematch offset="after_parent">^4-106019</prematch>
<regex offset="after_parent">^(\S+): IP packet from (\S+) to </regex>
<regex>(\S+), protocol (\w+) (\w+) </regex>
<order>id, srcip, dstip, protocol, action</order>
</decoder>
<decoder name="pix-fw5">
<parent>pix</parent>
<type>firewall</type>
<prematch offset="after_parent">^2-106006|^2-106007</prematch>
<regex offset="after_parent">^(\S+): (\w+) \S+ (\w+) from </regex>
<regex>(\d+.\d+.\d+.\d+)/(\d+) to (\d+.\d+.\d+.\d+)/(\d+) </regex>
<order>id, action, protocol, srcip, srcport, dstip, dstport</order>
</decoder>
<decoder name="pix-fw6">
<parent>pix</parent>
<type>firewall</type>
<prematch offset="after_parent">^6-106015</prematch>
<regex offset="after_parent">^(\S+): (\w+) (\w+) \S+ \S+ (\S+) from </regex>
<regex>(\S+)/(\S+) to (\S+)/(\S+)</regex>
<order>id, action, protocol, srcip, srcport, dstip, dstport</order>
</decoder>
<decoder name="pix-fw7">
<parent>pix</parent>
<type>firewall</type>
<prematch offset="after_parent">^6-305012</prematch>
<regex offset="after_parent">^(\S+): (\w+) \w+ (\w+) translation </regex>
<regex>from \w+:(\S+)/(\d+) to \w+:(\S+)/(\d+) </regex>
<order>id, action, protocol, srcip, srcport, dstip, dstport</order>
</decoder>
<decoder name="pix-fw8">
<parent>pix</parent>
<type>firewall</type>
<prematch offset="after_parent">^3-106011|^3-106010</prematch>
<regex offset="after_parent">^(\S+): (\w+) \.+ (\w+) src </regex>
<regex>\w+:(\S+)/(\d+) dst \w+:(\S+)/(\d+)</regex>
<order>id, action, protocol, srcip, srcport, dstip, dstport</order>
</decoder>
<decoder name="pix-attacks">
<parent>pix</parent>
<prematch offset="after_parent">^2-106012: |^2-106017: |</prematch>
<prematch>^2-106020|^1-106021|^1-106022|</prematch>
<prematch>^4-4000</prematch>
<regex offset="after_parent">^(\S+): \.+ from (\d+.\d+.\d+.\d+) </regex>
<order>id, srcip</order>
</decoder>
<decoder name="pix-srcip">
<parent>pix</parent>
<prematch offset="after_parent">^6-605004|^6-308001|^6-605005</prematch>
<regex offset="after_parent">^(\S+): \.+ (\d+.\d+.\d+.\d+)</regex>
<order>id, srcip</order>
</decoder>
<decoder name="pix-generic">
<parent>pix</parent>
<regex offset="after_parent">^(\S+): </regex>
<order>id</order>
</decoder>
<!-- Cisco IOS
- Group for Cisco IOS messages.
-->
<decoder name="cisco-ios">
<prematch>^%\w+-\d-\w+: </prematch>
</decoder>
<!-- Cisco IOS
- Will extract the action, srcip, srcport, dstip and dstport
- Samples:
-
- %SEC-6-IPACCESSLOGP: list 102 denied tcp 10.0.6.56(3067) -> 172.36.4.7(139), 1 packet
- %SEC-6-IPACCESSLOGP: list 199 denied tcp 10.0.61.108(1477) -> 10.0.127.20(445), 1 packet
-->
<decoder name="cisco-ios-acl">
<parent>cisco-ios</parent>
<type>firewall</type>
<prematch>^%SEC-6-IPACCESSLOGP: </prematch>
<regex offset="after_prematch">^list \d+ (\w+) (\w+) </regex>
<regex>(\S+)\((\d+)\) -> (\S+)\((\d+)\),</regex>
<order>action, protocol, srcip, srcport, dstip, dstport</order>
</decoder>
<!-- Cisco IOS IDS/IPS module
- Will extract the id, srcip, srcport, dstip and dstport
- Sep 1 10:25:29 10.10.10.1 %IPS-4-SIGNATURE: Sig:3051 Subsig:1 Sev:4 TCP Connection Window Size DoS [192.168.100.11:51654 -> 10.10.10.10:4444]
- Sep 1 10:25:29 10.10.10.1 %IPS-4-SIGNATURE: Sig:3051 Subsig:1 Sev:4 TCP Connection Window Size DoS [192.168.100.11:60797 -> 10.10.10.10:80]
- Sep 1 10:25:29 10.10.10.1 %IPS-4-SIGNATURE: Sig:5123 Subsig:2 Sev:5 WWW IIS Internet Printing Overflow [192.168.100.11:60797 -> 10.10.10.10:80]
-->
<decoder name="cisco-ios-ids">
<parent>cisco-ios</parent>
<type>ids</type>
<prematch>^%IPS-4-SIGNATURE: </prematch>
<regex offset="after_prematch">^Sig:(\d+) \.+[(\S+):(\d+) -> </regex>
<regex>(\S+):(\d+)]</regex>
<order>id, srcip, srcport, dstip, dstport</order>
<fts>name, id, srcip, dstip</fts>
<ftscomment>First time Cisco IOS IDS/IPS module rule fired.</ftscomment>
</decoder>
<!-- Cisco IOS
- Extracts the ID of cisco ios messages.
-->
<decoder name="cisco-ios-generic">
<parent>cisco-ios</parent>
<regex>^(%\w+-\d-\w+): </regex>
<order>id</order>
</decoder>
<!-- Cisco VPN Concentrator
- Will exatract srcip and username.
- Examples:
-
- Jan 8 09:10:37 vpn.example.com 11504 01/08/2007 09:10:37.780 SEV=3 AUTH/5 RPT=124 192.168.0.1 Authentication rejected: Reason = Unspecified handle = 805, server = auth.example.com, user = testuser, domain = <not specified>
11504 01/08/2007 09:10:37.780 SEV=3
-->
<decoder name="cisco-vpn-concentrator">
<prematch>^\d+ \d\d/\d\d/\d\d\d\d \S+ SEV=\d </prematch>
<regex offset="after_prematch">^(\S+) RPT=\d+ (\d+.\d+.\d+.\d+) </regex>
<order>id, srcip</order>
</decoder>
<!-- Snort decoder.
- Will extract the id, srcip and dstip
- Examples:
- snort: [1:469:3] ICMP PING NMAP [Classification: Attempted Information
Leak] [Priority: 2]: {ICMP} 10.4.12.26 -> 10.4.10.231
- snort: [1:1420:11] SNMP trap tcp [Classification: Attempted Information
Leak] [Priority: 2]: {TCP} 10.4.12.26:37020 -> 10.4.10.231:162
- [**] [1:1054:7] WEB-MISC weblogic/tomcat .jsp view source attempt [**]
[Classification: Web Application Attack]
[Priority: 1] 10.4.12.26:34041 -> 66.179.53.37:80
- [**] [1:1421:11] SNMP AgentX/tcp request [**]
[Classification: Attempted Information Leak] [Priority: 2]
10.4.3.20:626 -> 10.4.10.161:705
- [**] [1:1882:10] ATTACK-RESPONSES id check returned userid [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
{UDP} 192.168.20.32 -> 192.168.20.2
-->
<decoder name="snort">
<program_name>^snort</program_name>
</decoder>
<decoder name="snort">
<type>ids</type>
<prematch>^[**] [\d+:\d+:\d+] </prematch>
</decoder>
<decoder name="snort2">
<parent>snort</parent>
<type>ids</type>
<prematch>^[**] |^[\d+:\d+:\d+] </prematch>
<regex>^[**] [(\d+:\d+:\d+)] \.+ (\d+.\d+.\d+.\d+)\p*\d* -> </regex>
<regex>(\d+.\d+.\d+.\d+)|^[(\d+:\d+:\d+)] \.+ </regex>
<regex>(\d+.\d+.\d+.\d+)\p*\d* -> (\d+.\d+.\d+.\d+)</regex>
<order>id,srcip,dstip</order>
<fts>name,id,srcip,dstip</fts>
</decoder>
<!-- Dragon Decoder
- Will extract srcip, dstip and id
- Examples:
- 2007-02-24 00:07:30|xx-ids|MS:MDTC-DOS|1.2.3.4|5.6.7.8|123|456|I||6|tcp,xx
-
-->
<decoder name="dragon-nids">
<type>ids</type>
<prematch>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d\|</prematch>
<regex offset="after_prematch">^\S+\|(\S+)\|</regex>
<regex>(\d+.\d+.\d+.\d+)\|(\d+.\d+.\d+.\d+)\|</regex>
<order>id, srcip, dstip</order>
<fts>name, id, srcip, dstip</fts>
</decoder>
<!-- Horde decoder
- Will extract: username and srcip.
- Examples:
- [notice] [imp] Login success for raphaelv@xx [100.121.170.41] to {a.b.c:143} [on line 92 of "/home/webmail/horde/imp/redirect.php"]
- [error] [imp] FAILED LOGIN 210.179.154.213 to xxx:143[imap] as mala1
-->
<decoder name="horde_imp">
<prematch>^[\w+] [imp] |^[\w+] [horde] </prematch>
</decoder>
<decoder name="horde_imp_success">
<parent>horde_imp</parent>
<prematch offset="after_parent">^Login success </prematch>
<regex offset="after_prematch">^for (\S+) [(\d+.\d+.\d+.\d+)] </regex>
<order>user, srcip</order>
</decoder>
<decoder name="horde_imp_failed">
<parent>horde_imp</parent>
<prematch offset="after_parent">^FAILED LOGIN</prematch>
<regex offset="after_prematch">^ (\d+.\d+.\d+.\d+) to \S+ as (\S+) </regex>
<order>srcip, user</order>
</decoder>
<!-- Apache decoder.
- Will extract the srcip
- Examples:
- [error] [client 80.230.208.105] Directory index forbidden by rule: /home/
- [error] [client 64.94.163.159] Client sent malformed Host header
- [error] [client 66.31.142.16] File does not exist: /var/www/html/default.ida
- [notice] Apache configured
- httpd[18660]: [error] [client 12.34.56.78] File does not exist: /usr/local/htdocs/cache
- httpd[23745]: [error] [client 12.34.56.78] PHP Notice:
-->
<decoder name="apache-errorlog">
<program_name>^httpd</program_name>
</decoder>
<decoder name="apache-errorlog">
<prematch>^[warn] |^[notice] |^[error] </prematch>
</decoder>
<decoder name="apache-errorlog-ip">
<parent>apache-errorlog</parent>
<prematch offset="after_parent">^[client</prematch>
<regex offset="after_prematch">^ (\d+.\d+.\d+.\d+)] </regex>
<order>srcip</order>
</decoder>
<!-- NCSA common log decoder (used by apache, Lotus Domino and IIS NCSA).
- Will extract the srcip, url and id.
- Every web access log must use "web-accesslog" as their
- name if they want to be matched against the web rules.
- Examples:
- 63.91.167.39 - - [03/Aug/2001:21:56:18 -0700] "GET /default.ida?NNNN
- 206.78.62.16 - - [06/Aug/2001:08:57:08 -0700] "GET /default.ida?XX
- 5.211.112.6 - - [04/Feb/2003:16:17:30 -0500] "GET /mod_ssl:error:
- 192.168.2.190 - - [18/Jan/2006:13:10:06 -0500] "GET /xxx.html HTTP/1.1"
200 1732
- 1.1.1.1 - username [18/Jan/2006:13:10:06 -0500] "GET /xxx.html HTTP/1.1"
- 123.4.5.6 aa.xx.com - [05/Nov/2006:00:46:56 -0500] "GET / HTTP/1.1" 302 -
-->
<decoder name="web-accesslog">
<type>web-log</type>
<prematch>^\d+.\d+.\d+.\d+ </prematch>
<regex>^(\d+.\d+.\d+.\d+) \S+ \S+ [\S+ \S\d+] </regex>
<regex>"\w+ (\S+) HTTP\S+ (\d+) </regex>
<order>srcip, url, id</order>
</decoder>
<!-- Windows date format.
- Pre match for windows date format. Used on Windows firewall,
- IIS, etc.
- Examples:
- 2006-07-23 04:40:02 xxx
-->
<decoder name="windows-date-format">
<prematch>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d </prematch>
</decoder>
<!-- TitanFTP W3C Log Format - All Fields Populated version 5.99 - 6.
date time s-ip s-port -xssocket c-ip c-port x-csocket cs-username cs-bytes sc-bytes cs-uri-stem sc-status Message
date 15:13:50 209.189.228.200 22 0 192.168.10.220 0 912 0 0 - 0 Using "password" authentication for incoming user "root"
date 16:15:32 209.189.228.200 22 0 192.168.10.220 0 1004 root 0 0 - 38 User "root" account disabled; returning 530
-->
<decoder name="titanftp">
<parent>windows-date-format</parent>
<regex offset="after_parent">^\d+.\d+.\d+.\d+ \d+ \d+ (\d+.\d+.\d+.\d+.) \d+ \d+ (\S+)</regex>
<order>srcip, user</order>
</decoder>
<decoder name="titanftp-failed">
<parent>titanftp</parent>
<use_own_name>true</use_own_name>
<regex offset="after_parent">^(invalid)</regex>
<order>action</order>
</decoder>
<!-- Windows firewall decoder.
- Will extract action, protocol, srcip, dstip, srcport and dstport.
- Examples:
- 2006-09-18 22:25:30 OPEN TCP 11.12.72.10 12.252.71.6 3311 445 - - - - - - - - -
- 2006-09-18 22:26:23 DROP UDP 11.152.183.14 239.255.255.250 65299 1900 310 - - - - - - - RECEIVE
- 2006-09-18 22:26:23 DROP UDP 11.152.183.14 239.255.255.250 65299 1900 310 - - - - - - - RECEIVE
- 2006-09-18 22:26:23 DROP UDP 11.152.183.14 239.255.255.250 65298 1900 319 - - - - - - - RECEIVE
-->
<decoder name="windows-firewall">
<parent>windows-date-format</parent>
<type>firewall</type>
<use_own_name>true</use_own_name>
<prematch offset="after_parent">^OPEN|^CLOSE|^DROP</prematch>
<regex offset="after_parent">^(\w+) (\w+) </regex>
<regex>(\S+) (\S+) (\d+) (\d+) </regex>
<order>action, protocol, srcip, dstip, srcport, dstport</order>
</decoder>
<!-- IIS 5 WWW W3C log format.
- #Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status cs-host cs(User-Agent) cs(Referer)
- Examples:
- 2006-07-23 04:40:02 1.2.3.4 - W3SVC3 CIN1WEB03 1.2.3.4 443 GET /Default.asp - 200 hiden.com Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+Avant+Browser;+Avant+Browser;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) -
-->
<decoder name="web-accesslog-iis5">
<parent>windows-date-format</parent>
<type>web-log</type>
<use_own_name>true</use_own_name>
<prematch offset="after_parent">^\d+.\d+.\d+.\d+ \S+ W3SVC</prematch>
<regex offset="after_parent">^(\d+.\d+.\d+.\d+) \S+ \S+ \S+ \S+ </regex>
<regex>\d+ \S+ (\S+ \S+) (\d+) </regex>
<order>srcip,url,id</order>
</decoder>
<!-- IIS6 WWW W3C log format.
- #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem
cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent)
cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status
sc-bytes cs-bytes time-taken
- Examples:
- 2007-01-22 05:00:11 W3SVC1 HOSTNAME 1.1.1.1 POST /SimpleAuthWebService/SimpleAuth.asmx - 80 - 2.2.2.2 HTTP/1.1 Windows-Update-Agent - - hostname 200 0 0 1467 841 31
-->
<decoder name="web-accesslog-iis6">
<parent>windows-date-format</parent>
<type>web-log</type>
<use_own_name>true</use_own_name>
<prematch offset="after_parent">^W3SVC\d+ \S+ \S+ \S+ </prematch>
<regex offset="after_prematch">^(\S+ \S+) \d+ \S+ (\d+.\d+.\d+.\d+) </regex>
<regex>\S+ \S+ \S+ \S+ \S+ (\d+) </regex>
<order>url, srcip, id</order>
</decoder>
<!-- IIS 5 W3C FTP log format.
- Examples:
- #Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken cs-version cs-host cs(User-Agent) cs(Cookie) cs(Referer)
- 2006-07-23 17:57:59 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]USER Administrator - 331 0 0 0 0 FTP - - - -
- 2006-07-23 17:57:59 192.168.3.64 Administrator MSFTPSVC1 HAIJO2 192.168.1.12 21 [144]PASS - - 230 0 0 0 16 FTP - - - -
-->
<decoder name="msftp">
<parent>windows-date-format</parent>
<use_own_name>true</use_own_name>
<prematch offset="after_parent">^\d+.\d+.\d+.\d+ \S+ MSFTPSVC</prematch>
<regex offset="after_parent">^(\d+.\d+.\d+.\d+) (\S+) \S+ \S+ \S+ </regex>
<regex>\d+ [\d+](\S+) \S+ \S+ (\d+) </regex>
<order>srcip,user,action,id</order>
</decoder>
<!- 5 W3C SMTP log format (Exchange).
- Examples:
- #Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken cs-version cs-host cs(User-Agent) cs(Cookie) cs(Referer)
- 2006-10-09 14:04:46 69.217.186.117 - SMTPSVC1 MEE-PDC 192.168.X.X 0 xxxx -
> +hupylaw.hupy.local 500 0 32 23 0 SMTP - - - -
-->
<decoder name="msexchange">
<parent>windows-date-format</parent>
<use_own_name>true</use_own_name>
<prematch offset="after_parent">^\d+.\d+.\d+.\d+ \S+ SMTPSVC</prematch>
<regex offset="after_parent">^(\d+.\d+.\d+.\d+) \S+ \S+ \S+ \S+ </regex>
<regex>\d+ (\S+) \S+ \S+ (\d+) </regex>
<order>srcip, action, id</order>
</decoder>
<!-- Racoon VPN.
- Extract id (error or info) and ip address whenever possible.
- 2006-08-08 01:42:09: ERROR: couldn't find the pskey for 222.155.15.88.
-
-->
<decoder name="racoon">
<prematch>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d: </prematch>
</decoder>
<decoder name="racoon-failed">
<parent>racoon</parent>
<use_own_name>true</use_own_name>
<prematch offset="after_parent">^ERROR: couldn't find the pskey </prematch>
<regex offset="after_prematch">^for (\d+.\d+.\d+.\d+)</regex>
<order>srcip</order>
</decoder>
<decoder name="racoon-action">
<parent>racoon</parent>
<regex offset="after_parent">^(\w+): </regex>
<order>action</order>
</decoder>
<!-- Squid access log decoder.
- Will extract the srcip.
- Author: Ahmet Ozturk
- Examples:
- 1140701044.525 1231 192.168.1.201 TCP_DENIED/400 1536
GET ahmet - NONE/- text/html
- 1140701230.827 781 192.168.1.210 TCP_DENIED/407 1785
GET http://www.ossec.net oahmet NONE/- text/html
-->
<decoder name="squid-accesslog">
<type>squid</type>
<prematch>^\d+ \d+.\d+.\d+.\d+ </prematch>
<regex>^\d+ (\d+.\d+.\d+.\d+) (\w+)/(\d+) \d+ \w+ (\S+) </regex>
<order>srcip,action,id,url</order>
</decoder>
<!-- Windows decoder
- Will extract extra_data (as win source),action (as win category), id,
- username and computer name (as system_name).
- Examples:
- WinEvtLog: Application: INFORMATION(0x00000064): ESENT:
(no user)(no domain):
- WinEvtLog: Security: AUDIT_FAILURE(0x000002A9): Security:
SYSTEM: NT AUTHORITY: The logon to account: xyz by:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: la failed.
The error code was: 3221225572
- WinEvtLog: Security: AUDIT_FAILURE(0x00000211): Security:
SYSTEM: NT AUTHORITY: Logon Failure: Reason: Unknown user
name or bad password User Name: ab Domain: cd
Logon Type: 2 Logon Process: User32 Authentication
Package: Negotiate Workstation Name: ad
- WinEvtLog: Security: AUDIT_SUCCESS(538): Security: lac: OSSEC-HM: OSSEC-HM: User Logoff: User Name: lac Domain: OSSEC-HM Logon ID: (0x0,0x7C966E) Logon Type: 2
-->
<decoder name="windows">
<type>windows</type>
<prematch>^WinEvtLog: </prematch>
<regex offset="after_prematch">^\w+: (\w+)\((\d+)\): (\.+): </regex>
<regex>(\.+): \.+: (\S+): </regex>
<order>status, id, extra_data, user, system_name</order>
<fts>name, location, user, system_name</fts>
</decoder>
<!-- Windows decoder -NTsyslog format
- Will extract extra_data (as win source),action (as win category), id,
- username and computer name (as url).
- Examples:
- security[failure] 577 IBM17M\Jeremy Lee Privileged Service Called: Server:Security Service:- Primary User Name:IBM17M$ Primary Domain:LEETHERNET Primary Logon ID:(0x0,0x3E7) Client User Name:Jeremy Lee Client Domain:IBM17M Client Logon ID:(0x0,0x1447F) Privileges:SeSecurityPrivilege
- security[success] 528 IBM17M\Jeremy Lee Successful Logon: User Name:Jeremy Lee Domain:IBM17M Logon ID:(0x0,0x3A2E471) Logon Type:2 Logon Process:User32 Authentication Package:Negotiate Workstation Name:IBM17M Logon GUID: {00000000-0000-0000-0000-000000000000}
-->
<decoder name="windows-ntsyslog">
<type>windows</type>
<prematch>^security[\w+] \d+ </prematch>
<regex>^(\w+)[(\w+)] (\d+) </regex>
<order>extra_data, status, id</order>
</decoder>
<!-- Windows decoder - Snare format.
- Will extract extra_data (as win source), action (as category), id,
- username and computer name (as system_name).
-
- These logs must be tab-separated (as specified in the Snare format)
-
- Examples:
- Aug 11 11:11:11 xx.org MSWinEventLog 1 System 59221 Thu Aug 11 01:11:11 2006 17 Windows Update Agent Unknown User
- Jan 16 05:52:15 hostname.xx.org MSWinEventLog 1
Security 13049 Tue Jan 16 05:52:15 2007 680 Security
SYSTEM User Success Audit ACTUATE Account Logon
Account Used for Logon by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Account Name: IUSR_HOSTNAME Workstation: ACTUATE
12653
- Jan 16 13:02:24 hostname.yy.org MSWinEventLog 1
Application 14539 Tue Jan 16 13:02:24 2007 1704 SceCli
Unknown User N/A Information ACTUATE None Security
policy in the Group policy objects are applied successfully. 67
- Jan 16 15:41:37 hostname.zz.org MSWinEventLog 1 System
15059 Tue Jan 16 15:41:37 2007 10 Print username User
Information HOSTNAME None Document 76,
/directory/directory/directory/directory/directory/date/Afilename owned
by username was printed on hostname_duplex via port hostname_duplex.
Size in bytes: 19543296; pages printed: 162 361
-->
<decoder name="windows-snare">
<type>windows</type>
<prematch>^MSWinEventLog\t\d\t\.+\t\d+\t\w\w\w \w\w\w \d\d \d\d</prematch>
<regex offset="after_prematch">^:\d\d:\d\d \d\d\d\d\t(\d+)\t(\.+)</regex>
<regex>\t(\.+)\t\.+\t(\.+)\t(\.+)\t</regex>
<order>id, extra_data, user, status, system_name</order>
<fts>name, id, location, user, system_name</fts>
</decoder>
<!-- Symantec AV decoder.
- Source: http://www.ossec.net/wiki/index.php/Symantec_Antivirus
- Examples:
- 24090D00000A,4,3,7,ACMELABS-SRV2,SYSTEM,,,,,,,16777216,"Update to computer ACMELABS-LU2K3 of virus definition file 81011r succeeded.",0,,0,,,,,0,,,,,,,,,,,,,(IP)-192.168.49.66,ACMELABSav,ACMELABS,,8.1.825
- 24090D00000F,4,3,7,ACMELABS-SRV2,SYSTEM,,,,,,,16777216,"Update to computer ACMELABS-APPS-BOX4 of virus definition file 81011r succeeded.",0,,0,,,,,0,,,,,,,,,,,,,(IP)-192.168.49.66,ACMELABSav,ACMELABS,,8.1.825
- 240801012128,5,1,720997,RBLWAP,SYSTEM,Trojan.Zlob,C:\WINDOWS\system32\ld100.tmp,5,4,4,256,570441764,"",0,,0,,0,4254,0,0,0,0,0,0,20060830.022,58100,2,4,0,acme-AVSRV,{579642AA-5A5E-46E1-8613-2289349D1F27},,(IP)-192.168.100.237,acmeav,acme,,8.1.825
-->
<decoder name="symantec-av">
<prematch>^\w\w\w\w\w\w\w\w\w\w\w\w,</prematch>
<regex offset="after_prematch">^(\d+),\d+,\d+,(\S+),(\.+),</regex>
<order>id, system_name, extra_data</order>
<fts>name, location, id, system_name, extra_data</fts>
</decoder>
<!-- Symantec Web Security.
- Source: http://www.ossec.net/wiki/index.php/Symantec_Websecurity
- Examples:
- 20070717,30517,1=3,41=SWS-3.0.1.86/vendor-config,100=Version 3.0.6,3=7,2=29
- 20070717,73556,1=5,100=Logoff due to timeout.,11=1.2.3.4,10=usera,3=1,2=2
20070717,73559,1=5,11=2.3.4.5,10=userb,3=2,2=1
-->
<decoder name="symantec-websecurity">
<prematch>^\d\d\d\d\d\d\d\d,\d\d\d+,</prematch>
<plugin_decoder>SymantecWS_Decoder</plugin_decoder>
</decoder>
<!-- ossec decoder.
- Deals with ossec internal messages.
-->
<decoder name="ossec">
<prematch>^ossec: </prematch>
<type>ossec</type>
</decoder>
<decoder name="ossec-agent">
<parent>ossec</parent>
<type>ossec</type>
<prematch offset="after_parent">^Agent started:</prematch>
<regex offset="after_prematch">^ '(\S+)'</regex>
<order>extra_data</order>
<fts>name, location, extra_data</fts>
</decoder>
<!-- Zeus decoder.
- Will extract the severity and the srcip/username when available.
- Examples:
- [08/Aug/2006:22:32:12 +0100] WARN:admin:Authentication failure, url=/index.cgi, host=xx.yy.com, user=admin
- [10/Dec/2006:16:59:26 +0000] INFO:Zeus Admin Server running
-->
<decoder name="zeus">
<prematch>^[\d\d/\w\w\w/\d\d\d\d:\d\d:\d\d:\d\d \S+] </prematch>
<regex offset="after_prematch"> host=(\S+), </regex>
<order>srcip</order>
</decoder>
<!-- EOF -->