[ossec-list] Re: IIS rule to alert on blank cs-host

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

On IIS, when someone access a site via the IP address, the cs-host
field is populated
with the ip address instead of the hostname. So you can look for an ip
instead of a
blank cs-host entry.

You don't need to change the decoder for that, but just create a rule
that looks for an
IP in the cs-host. A simple way to do it is with the following regex
(just create a
local rule using that):

<regex>HTTP/1.0 \d+.\d+.\d+.\d+ \S+</regex>

Basically it looks for the http version followed by a cs-host that is
composed of an
IP address.

Hope it helps.

--
Daniel B. Cid
dcid ( at  ) ossec.net


On 4/19/07, List Subscriptions <lists.canuck.eh@xxxxxxxxx> wrote:
> In order to troubleshoot a web app I would like to have an IIS rule to
> alert when someone accesses a web page by IP address rather then
> hostname.  I believe this should be possible by having a rule that
> alerts on blank cs-host field.  Unfortunately I'm quite new to OSSEC
> and don't know how to accomplish this.  I believe modifications need
> to be made to both decoder.xml and a rules file.
>
> First I need to add cs-host to the following decoder, right?
>
> <decoder name="web-accesslog-iis6">
>   <parent>windows-date-format</parent>
>   <type>web-log</type>
>   <use_own_name>true</use_own_name>
>   <prematch offset="after_parent">^W3SVC\d+ \S+ \S+ \S+ </prematch>
>   <regex offset="after_prematch">^(\S+) \S+ \d+ \S+ (\d+.\d+.\d+.\d+) </regex>
>   <regex>\S+ \S+ \S+ \S+ \S+ (\d+) </regex>
>   <order>url, srcip, id</order>
> </decoder>
>
> Then write a rule looking for blank cs-host, right?
>
> Thanks in advance!