[ossec-list] Re: support for custom ids log

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Shawn,

You would need to write a decoder for your custom log format. Look
at the file decoders.xml for some examples...

*A simple decoder would be the following:

<decoder name="mycustom-decoder">
  <prematch>^\w+;\w+;\d+</prematch>
  <regex>^(\w+);(\w+);</regex>
  <order>id,system_name</order>
  <fts>name,id,system_name</fts>
</decoder>

It is basically going to create an FTS entry whenever it sees for the first
time an IDS id + system name combination. You can leverage that do
add source ips, protocols, usernames, etc...

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net


On 1/17/07, shawn reed <shwn_rd@xxxxxxxxx> wrote:
> Can you tell me if there's already support for me to
> use OSSEC correlation engine to analyze custom log
> files?
>
> I perform a daily dump from an ids with the following
> five fields:
>
> Event_name;Sensor_Name;Nbr_of_Events;Nbr_of_Sources;Nbr_of_Destinations
>
> Can OSSEC read these logs and alert on events that
> have never been seen?
>
>
>
> ____________________________________________________________________________________
> Do you Yahoo!?
> Everyone is raving about the all-new Yahoo! Mail beta.
> http://new.mail.yahoo.com