[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ossec-list
Subject:    [ossec-list] "parent" option in decoders
From:       "Ricardo Stocco" <ricardostocco () gmail ! com>
Date:       2008-10-31 19:35:15
Message-ID: acc7f75a0810311235w188b12c3j32f25a15a64fc451 () mail ! gmail ! com
[Download RAW message or body]

Hi,

I'm working with subdecoders and I have some doubts and questions.
I do not understand very well how ossec works when using the option "parent"
This is the "su decoder" in decoder.xml that ossec provides. Is this
configuration right? I think that there is a problem here....

**************************************************************************
<decoder name="su">
  <program_name>^su$</program_name>
</decoder>

<decoder name="su-detail">
  <parent>su</parent>
  <regex>^'su (\S+)' \S+ for (\S+) on \S+$</regex>
  <order>dstuser, srcuser</order>
  <fts>name, srcuser, location</fts>
</decoder>

<decoder name="su-detail2">
  <parent>su</parent>
  <regex>^BAD SU (\S+) to (\S+) on|</regex>
  <regex>^failed: \S+ changing from (\S+) to (\S+)|</regex>
  <regex>^\S \S+ (\S+)\p(\S+)$|^(\S+) to (\S+) on </regex>
  <order>srcuser, dstuser</order>
  <fts>name, srcuser, location</fts>
</decoder>

<decoder name="su">
  <prematch>^SU \S+ \S+ </prematch>
  <regex offset="after_prematch">^\S \S+ (\S+)-(\S+)$</regex>
  <order>srcuser, dstuser</order>
  <fts>name, srcuser, location</fts>
</decoder>
**************************************************************************


apparently, decoder "su-detail2" never works...

This seems to work fine with the prematch option.... for example:

<decoder name="su-detail">
  <parent>su</parent>
  *<prematch>^'su</prematch>
*  *<regex> (\S+)' \S+ for (\S+) on \S+$</regex>*
  <order>dstuser, srcuser</order>
  <fts>name, srcuser, location</fts>
</decoder>


It is right? How this really works? Where I can find more information about
decoders?


I hope you will understand me. I do not speak English very well...
thanks!

Ricardo

[Attachment #3 (text/html)]

<p>Hi,</p>
<p>I&#39;m working with subdecoders and I have some doubts and questions. <br>I do \
not understand very well how ossec works when using the option \
&quot;parent&quot;<br>This is the &quot;su decoder&quot; in decoder.xml that ossec \
provides. Is this configuration right? I think that there is a problem here....</p>

<p>**************************************************************************<br>&lt;decoder \
name=&quot;su&quot;&gt;<br>&nbsp; \
&lt;program_name&gt;^su$&lt;/program_name&gt;<br>&lt;/decoder&gt;</p> <p>&lt;decoder \
name=&quot;su-detail&quot;&gt;<br>&nbsp; &lt;parent&gt;su&lt;/parent&gt;<br>&nbsp; \
&lt;regex&gt;^&#39;su (\S+)&#39; \S+ for (\S+) on \S+$&lt;/regex&gt;<br>&nbsp; \
&lt;order&gt;dstuser, srcuser&lt;/order&gt;<br>&nbsp; &lt;fts&gt;name, srcuser, \
location&lt;/fts&gt;<br> &lt;/decoder&gt;</p>
<p>&lt;decoder name=&quot;su-detail2&quot;&gt;<br>&nbsp; \
&lt;parent&gt;su&lt;/parent&gt;<br>&nbsp; &lt;regex&gt;^BAD SU (\S+) to (\S+) \
on|&lt;/regex&gt;<br>&nbsp; &lt;regex&gt;^failed: \S+ changing from (\S+) to \
(\S+)|&lt;/regex&gt;<br> &nbsp; &lt;regex&gt;^\S \S+ (\S+)\p(\S+)$|^(\S+) to (\S+) on \
&lt;/regex&gt;<br>&nbsp; &lt;order&gt;srcuser, dstuser&lt;/order&gt;<br>&nbsp; \
&lt;fts&gt;name, srcuser, location&lt;/fts&gt;<br>&lt;/decoder&gt;</p> <p>&lt;decoder \
name=&quot;su&quot;&gt;<br>&nbsp; &lt;prematch&gt;^SU \S+ \S+ \
&lt;/prematch&gt;<br>&nbsp; &lt;regex offset=&quot;after_prematch&quot;&gt;^\S \S+ \
(\S+)-(\S+)$&lt;/regex&gt;<br>&nbsp; &lt;order&gt;srcuser, dstuser&lt;/order&gt;<br> \
&nbsp; &lt;fts&gt;name, srcuser, \
location&lt;/fts&gt;<br>&lt;/decoder&gt;<br>**************************************************************************</p>
 <p><br>apparently, decoder &quot;su-detail2&quot; never works...</p>
<p>This seems to work fine with the prematch option.... for example:</p>
<p>&lt;decoder name=&quot;su-detail&quot;&gt;<br>&nbsp; \
&lt;parent&gt;su&lt;/parent&gt;<br>&nbsp; \
<strong>&lt;prematch&gt;^&#39;su&lt;/prematch&gt;<br></strong>&nbsp; \
<strong>&lt;regex&gt; (\S+)&#39; \S+ for (\S+) on \S+$&lt;/regex&gt;</strong><br> \
&nbsp; &lt;order&gt;dstuser, srcuser&lt;/order&gt;<br>&nbsp; &lt;fts&gt;name, \
srcuser, location&lt;/fts&gt;<br>&lt;/decoder&gt;</p> <p>&nbsp;<br>It is right? How \
this really works? Where I can find more information about decoders?</p> <p><br>I \
hope you will understand me. I do not speak English very well... </p> \
<div>thanks!</div> <div>&nbsp;</div>
<div>Ricardo</div>



[prev in list] [next in list] [prev in thread] [next in thread]