Approaching Ossim sensor plug-in

Approaching Ossim sensor plug-in

In the last post to introduce the Ossim architecture of the composition, and then to introduce its "mysterious" plug-ins, read the plugin before you are familiar with the regular expression.

Sensor Enable plugin List

[Plugins]

Apache=/etc/ossim/agent/plugins/apache.cfg

Nmap-monitor=/etc/ossim/agent/plugins/nmap-monitor.cfg

Ossec-single-line=/etc/ossim/agent/plugins/ossec-single-line.cfg

Ossim-monitor=/etc/ossim/agent/plugins/ossim-monitor.cfg

Pam_unix=/etc/ossim/agent/plugins/pam_unix.cfg

Ping-monitor=/etc/ossim/agent/plugins/ping-monitor.cfg

Prads_eth0=/etc/ossim/agent/plugins/prads_eth0.cfg

Ssh=/etc/ossim/agent/plugins/ssh.cfg

Sudo=/etc/ossim/agent/plugins/sudo.cfg

Suricata=/etc/ossim/agent/plugins/suricata.cfg

Whois-monitor=/etc/ossim/agent/plugins/whois-monitor.cfg

Wmi-monitor=/etc/ossim/agent/plugins/wmi-monitor.cfg

The sensor plugin sends preprocessing data to the server, defined as

[Output-server]

Enable=true

ip=192.168.91.228

port=40001

Send_events=true

The following is an example of an Apache plugin that looks at the regular expression in a plugin:

[0001-apache-access] Access Log

Event_type=event

Regexp= (? p\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) (:(? p\d{1,5}))? )? (? p\s+) (? p\s+) (? p\s+) \[(? P\D{2}\/\W{3}\/\D{4}:\D{2}:\D{2}:\D{2}) \s+[+-]\d{4}\] \ "(? P[^\ "]*) \" (? P\d{3}) ((?P\d+)|-)( \"(?P[^\"]*)\" \"(?P[^\"]*)\")?$

Src_ip={resolv ($SRC)}

Dst_ip={resolv ($DST)}

dst_port={$port}

Date={normalize_date ($date)}

plugin_sid={$code}

username={$user}

userdata1={$request}

userdata2={$size}

userdata3={$referer _uri}

userdata4={$useragent}

filename={$id}

[0002-apache-error] error Log

Event_type=event

regexp=\[(? P\W{3} \w{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}) \] \[(? P (Emerg|alert|crit|error|warn|notice|info|debug)) \] (\[client (? p\s+) \])? (? p.*)

Date={normalize_date ($date)}

Plugin_sid={translate ($type)}

Src_ip={resolv ($SRC)}

userdata1={$data}

If you are not familiar with the basic format of Apache logs, see the book "Unix/linux Network log analysis and traffic monitoring".

If you are forwarding Apache logs through a syslog, then this is the case:

[0001-apache-syslog-access]
Event_type=event
regexp=^\w{3}\s+\d{1,2} \d\d:\d\d:\d\d (? p\s+) \s+: (? p\s+) (:(? p\d{1,5}))? )? (? p\s+) (? p\s+) (? p\s+) \[(? P\D{2}\/\W{3}\/\D{4}:\D{2}:\D{2}:\D{2}) \s+[+-]\d{4}\] \ "(? p.*) \ "(? P\d{3}) ((?P\d+)|-)( \"(?P.*)\" \"(?P.*)\")?$
src_ip={resolv($src)}
dst_ip={resolv($dst)}
dst_port={$port}
device={resolv($device)}
date={normalize_date($date)}
plugin_sid={$code}
username={$user}
userdata1={$request}
userdata2={$size}
userdata3={$referer_uri}
userdata4={$useragent}
filename={$id}

[0002-apache-syslog-error]
Event_type=event
regexp=^ (? p\w{3}\s+\d{1,2} \d\d:\d\d:\d\d) (? p\s+) \s+: \[(? P (Emerg|alert|crit|error|warn|notice|info|debug)) \] (\[client (? p\s+) \])? (? p.*)
Date={normalize_date ($date)}
Dst_ip={resolv ($device)}
Device={resolv ($device)}
Date={normalize_date ($date)}
Plugin_sid={translate ($type)}
Src_ip={resolv ($SRC)}
userdata1={$data}

Each type of plug-in corresponds to a plug-in ID, everyone in the use of Siem Event analysis to remember the ID number (see more understand), if you want to learn more about this plugin-based log collection processing method, please refer to "open Source safe operation Dimensional plane-ossim best practice" book.

This article is from the "Lee Chenguang Original Technology blog" blog, please be sure to keep this source http://chenguang.blog.51cto.com/350944/1739278

Approaching Ossim sensor plug-in