/etc/prelude-lml/ruleset/cisco-ips.rules is in prelude-lml-rules 4.1.0-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 | #FULLNAME: Cisco IPS
#VERSION: 1.0
#DESCRIPTION: Cisco IPS is a network security appliance that monitor network and/or system activities for malicious activity.
#DESCRIPTION: The rules included here were developed using a Cisco IPS module running on an ASA.
#DESCRIPTION: Special configuration is needed for this support:
#DESCRIPTION: * In your IDM interface, "SNMP" -> "Traps Configuration", "Enable SNMP Traps"
#DESCRIPTION: box must be on. "Enable detailed traps for alerts" must be off.
#DESCRIPTION: * In your IDM interface, "Signature Definition" -> "Signature Configuration",
#DESCRIPTION: all of the rules must be modified using the "Select All" button, followed
#DESCRIPTION: by the "Actions" button, and click the "Request SNMP Trap" box on.
#DESCRIPTION: * On your Prelude system, run snmptrapd using this command:
#DESCRIPTION: "snmptrapd -Ls 16 -Osq"
#####
#
# Copyright (C) 2006 G Ramon Gomez <gene at gomezbrothers dot com>
# Ragingwire Enterprise Solutions (www.ragingwire.com)
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####
#DESCRIPTION:Cisco IPS event
#CATEGORY:Generic IDS/IPS
#LOG:Nov 22 10:04:09 SOMEHOST snmptrapd[28547]: 2006-11-22 10:04:09 somehost.somedomain.com [192.168.134.193]: sysUpTime.0 54:17:25:06.49 snmpTrapOID.0 enterprises.9.9.383.0.1 enterprises.9.9.383.1.1.1 1159501964404429847 enterprises.9.9.383.1.1.2 "07 D6 0B 16 0A 04 0F 00 " enterprises.9.9.383.1.1.3 "07 D6 0B 16 12 04 0F 00 " enterprises.9.9.383.1.1.4 "SOMEHOST" enterprises.9.9.383.1.2.1 "low" enterprises.9.9.383.1.2.2 2147483648 enterprises.9.9.383.1.2.4 "ICMP Network Sweep w/Echo"enterprises.9.9.383.1.2.5 2100 enterprises.9.9.383.1.2.6 0 enterprises.9.9.383.1.2.16 "192.168.134.30" enterprises.9.9.383.1.2.17 "192.168.129.28"
#LOG:Nov 22 10:04:01 SOMEHOST snmptrapd[28547]: 2006-11-22 10:04:01 somehost.somedomain.com [192.168.134.193]: sysUpTime.0 54:17:24:58.20 snmpTrapOID.0 enterprises.9.9.383.0.1 enterprises.9.9.383.1.1.1 1159501964404429845 enterprises.9.9.383.1.1.2 "07 D6 0B 16 0A 04 07 00 " enterprises.9.9.383.1.1.3 "07 D6 0B 16 12 04 07 00 " enterprises.9.9.383.1.1.4 "SOMEHOST" enterprises.9.9.383.1.2.1 "medium" enterprises.9.9.383.1.2.2 2147483648 enterprises.9.9.383.1.2.4 "Web Client Remote Code Execution Vulnerability" enterprises.9.9.383.1.2.5 5732 enterprises.9.9.383.1.2.6 2 enterprises.9.9.383.1.2.16 "192.168.129.29:0" enterprises.9.9.383.1.2.17 "0.0.0.0:0"
regex=(\S+) \[([\d\.]+)\]:.+enterprises.9.9.383.1.2.1 "(low|medium|high)".+enterprises.9.9.383.1.2.4 "(.+?)"\s*enterprises.9.9.383.1.2.5 (\d+)\s+enterprises.9.9.383.1.2.6 (\d+).+enterprises.9.9.383.1.2.16 "([\d\.]+):?(\d+)?"\s+enterprises.9.9.383.1.2.17 "([\d\.]+):?(\d+)?"; \
classification.text=$4; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=ips_id; \
classification.reference(0).name=$5.$6; \
classification.reference(0).url=http://tools.cisco.com/MySDN/Intelligence/viewSignature.x?signatureId=$5&signatureSubId=$6; \
id=5000; \
revision=1; \
analyzer(0).name=IPS; \
analyzer(0).manufacturer=Cisco; \
analyzer(0).class=IDS; \
analyzer(0).node.name=$1; \
analyzer(0).node.address(0).address=$2; \
assessment.impact.severity=$3; \
assessment.impact.description=This event was generated by the Cisco IPS; \
source(0).node.address(0).category=ipv4-addr; \
source(0).node.address(0).address=$7; \
source(0).service.port=$8; \
target(0).node.address(0).category=ipv4-addr; \
target(0).node.address(0).address=$9; \
target(0).service.port=$10; \
last
|