[ossec-list] Re: IIS rule to alert on blank cs-host

["List Subscriptions" <lists.canuck.eh@xxxxxxxxx>]

That's exactly what I want to do so I've added a rule to the
local_rules.xml but I can't seem to get it to fire.

<group name="web,local,">
 <rule id="123456" level="10">
   <regex>HTTP/1.1 \d+.\d+.\d+.\d+ \S+</regex>
   <description>Website accessed by IP not hostname</description>
 </rule>
</group>

Any ideas?


On 4/20/07, Daniel Cid <daniel.cid@xxxxxxxxx> wrote:
> On IIS, when someone access a site via the IP address, the cs-host
> field is populated
> with the ip address instead of the hostname. So you can look for an ip
> instead of a
> blank cs-host entry.
>
> You don't need to change the decoder for that, but just create a rule
> that looks for an
> IP in the cs-host. A simple way to do it is with the following regex
> (just create a
> local rule using that):
>
> <regex>HTTP/1.0 \d+.\d+.\d+.\d+ \S+</regex>
>
> Basically it looks for the http version followed by a cs-host that is
> composed of an
> IP address.
>
> Hope it helps.
>
> --
> Daniel B. Cid
> dcid ( at  ) ossec.net
>
>
> On 4/19/07, List Subscriptions <lists.canuck.eh@xxxxxxxxx> wrote:
> >
> > In order to troubleshoot a web app I would like to have an IIS rule to
> > alert when someone accesses a web page by IP address rather then
> > hostname.  I believe this should be possible by having a rule that
> > alerts on blank cs-host field.  Unfortunately I'm quite new to OSSEC
> > and don't know how to accomplish this.  I believe modifications need
> > to be made to both decoder.xml and a rules file.
> >
> > First I need to add cs-host to the following decoder, right?
> >
> > <decoder name="web-accesslog-iis6">
> >   <parent>windows-date-format</parent>
> >   <type>web-log</type>
> >   <use_own_name>true</use_own_name>
> >   <prematch offset="after_parent">^W3SVC\d+ \S+ \S+ \S+ </prematch>
> >   <regex offset="after_prematch">^(\S+) \S+ \d+ \S+ (\d+.\d+.\d+.\d+) </regex>
> >   <regex>\S+ \S+ \S+ \S+ \S+ (\d+) </regex>
> >   <order>url, srcip, id</order>
> > </decoder>
> >
> > Then write a rule looking for blank cs-host, right?
> >
> > Thanks in advance!
> >