Improved ossec-logtest to be used for the forensic analysis of log files (more info)
Added support for Microsoft Security Essentials logs.
And a few important bug fixes:
Fixed a memory leak on the Windows agent that was not properly closing the sockets. It would cause a port exhaustion if the manager becames unavailable
for a long period of time.
Fixed performance issue when the FTS queue was too large.
Check out our v2.4 changelog for the complete list of new features and bugs fixed.
If you ever wanted to contribute to OSSEC (or to any open source project) that’s the easiest way to get involved. Just download the BETA, check if everything still works, if you have time try out some of the new features and let us know how it goes. You can submit your feedback in here, via the wiki, to the mailing list or personally to me via email.
Thanks to everyone who sent some notes that our site was down last night. We were switching servers and not everything got migrated on time. I was happy that sucuri notified my on time:
Modifications:
%WARN: Size reduced by more than 50%. - Previous size: 2761. Current size: 984 (in bytes)
%INFO: Server setting changes - > <title>WordPress › Error
%ERROR: Error establishing a database connection
Changes follow:
14,20c14
< <title>
< Welcome to the Home of OSSEC
..
> Error establishing a database connection
They have a nice solution that does integrity checking on web sites, domains, etc. That was the other alert I got:
Sucuri nbim: http://www.ossec.net DNS modified
Modifications:
5d4
< ossec.net has address 75.126.x.z
> ossec.net has address 74.86.x.z
Xavier wrote a very interesting article on Detecting USB Storage Usage with OSSEC. He used our policy auditing module for that, but I think USB monitoring can be done in a much easier way with our new check_diff feature. You need our latest snapshot for it to work (or wait until v2.4 is out).
To get started, first configure your Windows agents to monitor the USBSTOR registry entry using the reg command:
Now after a few minutes you will see a directory at /var/ossec/queue/diff/[agent_name]/[rule_id] with the current snapshot of this command. Once someone adds a new USB device you will get this alert:
If you want to create alerts when a log or the output of a command changes, take a look at the new <check_diff /> option in the rules (available on the latest snapshot).
To demonstrate with an example, we will create a rule to alert when there is a new port open in listening mode on our server.
First, we configure OSSEC to run the ‘netstat -tan |grep LISTEN’ command by adding the following to ossec.conf:
Note that we use the <check_diff /> option. The first time it receives the event, it will store in an internal database. Every time it receives the same event, it will compare against what we have store and only alert if the output changes.
In our example, after configuring OSSEC, I started netcat to listen on port 23456 and that’s the alert I got:
Then you will be able to use the “reports” option to configure what alerts do you want to receive summarized by the end of the day (instead of in realtime). You can use the following options:
group: Filter by group categories: Filter by group (alias to the above) rule: Filter by rule id level: Filter by severity location: Filter by the log location or agent name srcip: Filter by a source ip user: Filter by an user name
You can also use the same options with the ‘type=”relation” specified to get the relation between fields. For example <srcip type=”relation”>user</srcip> will get you a list of users per source ip.
Every report must have a <title> specified and as many “email_to” as you want.
Example 1: Receive summary of all the authentication success:
The OSSEC community is on fire lately! We are very happy to see everyone talking and presenting about OSSEC. Those are some of the newest updates from our community:
Wim Remes spoke about OSSEC at the Fosdem conference. The video of his presentation is on youtube:
I am happy to announce the arrival of the newest member of the OSSEC team. Priscila Cid joined our team yesterday and even though she is only 50 cm tall, she is already very active and doing very well.
OSSEC works well for real time analysis of log files. However, if you have one old log file that you want to check or if you are doing a forensics analysis of a box and wants to check the logs with OSSEC, we now have a solution too.
*the feature mentioned in here is only available on latest snapshots
Let’s say you have a file /var/log/secure that you want to analyze with OSSEC. You need to use the ossec-logtest tool with the “-a” flag to reproduce the alerts:
# cat /var/log/secure | /var/ossec/bin/ossec-logtest -a
** Alert 1264788284.11: - syslog,sshd,authentication_success,
2010 Jan 29 14:04:44 enigma->stdin
Rule: 5715 (level 3) -> ‘SSHD authentication success.’
Src IP: a.b.2.15
User: dcid
Jan 15 10:25:01 enigma sshd[17594]: Accepted password for dcid from a.b.2.15 port 47526 ssh2
** Alert 1264788284.12: - syslog,sshd,authentication_success,
2010 Jan 29 14:04:44 enigma->stdin
Rule: 5715 (level 3) -> ‘SSHD authentication success.’
Src IP: 127.0.0.1
User: dcid
Jan 15 11:19:20 enigma sshd[18853]: Accepted publickey for dcid from 127.0.0.1 port 6725 ssh2
You will get the alerts just like you would at /var/ossec/logs/alerts.log. The benefit now is that you can pipe this output to ossec-reported to get a better view of what is going on:
*Special thanks to our contributors Jeremy Rossi, Fabio Paracchini and Michael Starks and our beta testers Dan Parriott, Michael Starks, Timo Vehvilainen and Jeremy Rossi.
