prelude-lml-rules 4.1.0-1 / etc / prelude-lml / ruleset / checkpoint.rules

#FULLNAME: Check Point
#VERSION: 1.0
#DESCRIPTION: The Check Point Firewall Software builds on the technology first offered in Check Point’s FireWall-1 solution to provide strong gateway security and identity awareness. TODO: Audit (and probably re-write) all SmartDefense events

#####
#
# Copyright (C) 2003 Exaprobe
# All Rights Reserved
#
# This ruleset is currently unmaintained.  Contact the Prelude
# development team if you would like to maintain it.
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####

#DESCRIPTION:Packet denied (Both ports are numbers)
#CATEGORY:Packet Filtering
regex=drop   ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: (\d+). proto: (\w+). rule: (\d+); \
 classification.text=$8 packet denied; \
 id=100; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged a $8 packet sent by $4:$5 to $6:$7 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.port=$5; \
 source(0).service.protocol=$8; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 target(0).service.port=$7; \
 target(0).service.protocol=$8; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=$9; \
 last

#DESCRIPTION:Packet denied (Source or Target port is a service name)
#CATEGORY:Packet Filtering
regex=drop   ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=$8 packet denied; \
 id=101; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged a $8 packet sent by $4:$5 to $6:$7 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.port=$5; \
 source(0).service.protocol=$8; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 target(0).service.name=$7; \
 target(0).service.protocol=$8; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=$9; \
 last

#DESCRIPTION:Packet denied
#CATEGORY:Packet Filtering
regex=drop   ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: (\d+). proto: (\w+). rule: (\d+); \
 classification.text=$8 packet denied; \
 id=102; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged a $8 sent by $4:$5 to $6:$7 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.name=$5; \
 source(0).service.protocol=$8; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 target(0).service.port=$7; \
 target(0).service.protocol=$8; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=$9; \
 last

#DESCRIPTION:Packet denied (Both ports are service names)
#CATEGORY:Packet Filtering
regex=drop   ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=$8 packet denied; \
 id=103; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged a $8 packet sent by $4:$5 to $6:$7 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.name=$5; \
 source(0).service.protocol=$8; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 target(0).service.name=$7; \
 target(0).service.protocol=$8; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=$9; \
 last

#DESCRIPTION:Packet accepted (Both ports are numbers)
#CATEGORY:Packet Filtering
regex=accept ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: (\d+). proto: (\w+). rule: (\d+); \
 classification.text=$8 packet accepted; \
 id=104; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 accepted and logged a $8 packet sent by $4:$5 to $6:$7 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.port=$5; \
 source(0).service.protocol=$8; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 target(0).service.port=$7; \
 target(0).service.protocol=$8; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=$9; \
 last

#DESCRIPTION:Packet accepted (One port is a service name)
#CATEGORY:Packet Filtering
#LOG:14Aug2006 16:38:54 accept 12.34.56.78 >eth1c0 product: VPN-1 & FireWall-1; src: 90.12.34.56; s_port: 41307; dst: 78.90.12.34; service: domain-udp; proto: udp; rule: 8;
regex=accept ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=$8 packet accepted; \
 id=105; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 accepted and logged a $8 packet sent by $4:$5 to $6:$7 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.port=$5; \
 source(0).service.protocol=$8; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 target(0).service.name=$7; \
 target(0).service.protocol=$8; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=$9; \
 last

#DESCRIPTION:Packet accepted
#CATEGORY:Packet Filtering
regex=accept ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: (\d+). proto: (\w+). rule: (\d+); \
 classification.text=$8 packet accepted; \
 id=106; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 accepted and logged a $8 packet sent by $4:$5 to $6:$7 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.name=$5; \
 source(0).service.protocol=$8; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 target(0).service.port=$7; \
 target(0).service.protocol=$8; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=$9; \
 last

#DESCRIPTION:Packet accepted (Only service names)
#CATEGORY:Packet Filtering
regex=accept ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=$8 packet accepted; \
 id=107; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 accepted and logged a $8 packet sent by $4:$5 to $6:$7 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.name=$5; \
 source(0).service.protocol=$8; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 target(0).service.name=$7; \
 target(0).service.protocol=$8; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=$9; \
 last

#DESCRIPTION:Packet denied (ICMP)
#CATEGORY:Packet Filtering
regex=drop   ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). dst: ([\d\.]+). proto: icmp. icmp-type: (\d+). icmp-code: (\d+). rule: (\d+); \
 classification.text=ICMP packet denied; \
 id=108; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged an icmp packet sent by $4 to $5, with type $6 and code $7 (rule #$8); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.protocol=icmp; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$5; \
 target(0).service.protocol=icmp; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ICMP type; \
 additional_data(0).data=$6; \
 additional_data(1).type=integer; \
 additional_data(1).meaning=ICMP code; \
 additional_data(1).data=$7; \
 additional_data(2).type=integer; \
 additional_data(2).meaning=ACL; \
 additional_data(2).data=$8; \
 last

#DESCRIPTION:Packet accepted (ICMP)
#CATEGORY:Packet Filtering
regex=accept ([\d+\.]+) (<|>)([\w-]+) product: VPN-1 & FireWall-1. src: ([\d\.]+). dst: ([\d\.]+). proto: icmp. icmp-type: (\d+). icmp-code: (\d+). rule: (\d+); \
 classification.text=ICMP packet accepted; \
 id=109; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 dropped and logged an icmp packet sent by $4 to $5, with type $6 and code $7 (rule #$8); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).service.protocol=icmp; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$5; \
 target(0).service.protocol=icmp; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ICMP type; \
 additional_data(0).data=$6; \
 additional_data(1).type=integer; \
 additional_data(1).meaning=ICMP code; \
 additional_data(1).data=$7; \
 additional_data(2).type=integer; \
 additional_data(2).meaning=ACL; \
 additional_data(2).data=$8; \
 last

#DESCRIPTION:Packet logged
#CATEGORY:Packet Filtering
regex=product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=Packet logged; \
 id=110; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion = failed; \
 assessment.impact.type = other; \
 assessment.impact.severity = low; \
 assessment.impact.description=FireWall-1 has logged a $5 packet sent by $1:$2 to $3:$4 (rule #$6); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$1; \
 source(0).service.protocol=$5; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$3; \
 target(0).service.protocol=$5; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=ACL; \
 additional_data(0).data=$6; \
 last

#DESCRIPTION:Generic VPN-1 / FW-1 alert
#CATEGORY:Packet Filtering
#LOG:14Aug2006 16:38:54 accept 12.34.56.78 >eth1c0 product: VPN-1 & FireWall-1; src: 90.12.34.56; s_port: 41307; dst: 78.90.12.34; service: domain-udp; proto: udp; rule: 8;
regex=product: VPN-1 & FireWall-1; \
 classification.text=Generic alert; \
 id=111; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=VPN-1 & FireWall-1 generic alert; \
 last

#DESCRIPTION:SmartDefense - Attack
#CATEGORY:Network Security
#LOG:14Aug2006 16:39:44        12.34.56.78 >    alert product: SmartDefense; cpmad: CPMAD; attack: Port Scanning; dst: 90.12.34.56; src: 78.90.12.34;
regex=product: SmartDefense\;.+attack: (.+)\; dst: ([\d\.]+)\; src: ([\d\.]+); \
 classification.text=$1; \
 id=112; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.severity=low; \
 assessment.impact.type=recon; \
 assessment.impact.description=Checkpoint SmartDefense has detected a $1 from $3 to $2; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$2; \
 last

#DESCRIPTION:SmartDefense - Successive multiple connections
#CATEGORY:Network Security
regex=product: SmartDefense. service: ([\w-]+|\d+). attack: Successive Multiple Connections. dst: ([\d\.]+). src: ([\d\.]+); \
 classification.text=Successive multiple connections; \
 id=114; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=Checkpoint Smart Defense: multiple connections from $3 to $2:$1; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$2; \
 target(0).service.name=$1; \
 last

#DESCRIPTION:SmartDefense - Attack (Port number to port number)
#CATEGORY:Network Security
regex=product: SmartDefense\;.+attack: (.+)\; src: ([\d\.]+)\; s_port: (\d+)\; dst: ([\d\.]+)\; service: (\d+)\; proto: ([\w\-]+|\d+); \
 classification.text=$1; \
 id=115; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=$1 sent by $2:$3 to $4:$5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.port=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.port=$5; \
 last

#DESCRIPTION:SmartDefense - Attack (Port number to service name)
#CATEGORY:Network Security
regex=product: SmartDefense. Attack Info: (.+). attack: Bad packet. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: ([\w-]+). proto: ([\w-]+|\d+); \
 classification.text=Bad $6 flags; \
 id=116; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description= $1 sent by $2:$3 to $4:$5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.port=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.name=$5; \
 last

#DESCRIPTION:SmartDefense - Attack (Service name to service name)
#CATEGORY:Network Security
regex=product: SmartDefense. Attack Info: (.+). attack: Bad packet. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: ([\w-]+). proto: ([\w-]+|\d+); \
 classification.text=Bad $6 flags; \
 id=117; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description= $1 sent by $2:$3 to $4:$5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.name=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.name=$5; \
 last

#DESCRIPTION:SmartDefense - Attack (Service name to port number)
#CATEGORY:Network Security
regex=product: SmartDefense. Attack Info: (.+). attack: Bad packet. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: (\d+). proto: ([\w-]+|\d+); \
 classification.text=Bad $6 flags; \
 id=118; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description= $1 sent by $2:$3 to $4:$5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.name=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.port=$5; \
 last

#DESCRIPTION:SmartDefense - Attack (Large ping)
#CATEGORY:Network Security
regex=product: SmartDefense\;.+attack: (.+)\; src: ([\d\.]+)\; dst: ([\d\.]+); \
 classification.text=$1; \
 id=119; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=$1 sent by $2 to $3; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$3; \
 last

#DESCRIPTION:SmartDefense - Attack
#CATEGORY:Network Security
#LOG:14Aug2006 16:39:44        12.34.56.78 >    alert product: SmartDefense; cpmad: CPMAD; attack: Port Scanning; dst: 90.12.34.56; src: 78.90.12.34;
regex=product: SmartDefense\;.+attack: (.+?)\;; \
 classification.text=$1; \
 id=125; \
 revision=2; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.severity=low; \
 assessment.impact.type=other; \
 assessment.impact.description=Checkpoint SmartDefense has detected a $1; \
 last

#DESCRIPTION:SmartDefense - Generic alert
#CATEGORY:Network Security
#LOG:14Aug2006 16:39:44        12.34.56.78 >    alert product: SmartDefense; cpmad: CPMAD; attack: Port Scanning; dst: 90.12.34.56; src: 78.90.12.34;
regex=product: SmartDefense; \
 classification.text=Misc logs; \
 id=126; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=Checkpoint Smart Defense: generic alert; \
 last

#DESCRIPTION:System Alert message
#CATEGORY:Monitoring
regex=([\d+\.]+) (<|>)\s+(\w+) System Alert message: (.+). Object: (\w+). (.+). product: System Monitor; \
 classification.text=Checkpoint System Monitor; \
 id=127; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=System alert reported a $4; \
 last