prelude-lml-rules 4.1.0-1 / etc / prelude-lml / ruleset / xg45-datapower.rules

#FULLNAME: DataPower XG45
#VERSION: 1.0
#DESCRIPTION: DataPower SOA Appliances is a family of pre-built, pre-configured rack mountable network devices (XML appliances) that can help accelerate XML and Web Services deployments while extending SOA infrastructure.
#DESCRIPTION: The rules included here were developed using a IBM Data Power xG45.
#DESCRIPTION: Special configuration is needed for the support:
#DESCRIPTION: * In your DPW Web interface:
#DESCRIPTION:   - Go to "Control Panel -> Administration -> Access -> SNMP Settings" and create
#DESCRIPTION:   a new SNMP destination for send traps in "Trap and Notification Targets".
#DESCRIPTION:   - Then, go to "Control Pannel -> Objects -> Logging Configuration -> Log Target",
#DESCRIPTION:   and create a new log target to send traps. You must select "Target Type: SNMP",
#DESCRIPTION:   "Timestamp Format: syslog" in "General Configuration", and select a "Event Category = all,
#DESCRIPTION:   and "Minimum Event Priority = notice" in the "Event Subscriptions" tab.
#DESCRIPTION:   - In The "Trap Event Subscriptions", select "Enable Default Event Subscriptions = on" and
#DESCRIPTION:   "Minimum Priority = debug".
#DESCRIPTION:   Note: You can suppress messages from your DPW by adding the event log ID on
#DESCRIPTION:   "Event Suppression Filter"  in the "Event Filters" tab, on log target configuration form.
#DESCRIPTION: * On your Prelude system, run snmptrapd using this command:
#DESCRIPTION:   "snmptrapd -Ls 16 -Osq"

#####
#
# Copyright (C) 2012 Seguridadx <operador@seguridadx.com>
# twitter: <www.twitter.com/seguridad_x>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####

#DESCRIPTION:Event generated by the XML Firewall of IBM (High impact)
#CATEGORY:Network Security
#LOG:Mar 8 17:08:02 prelude-siem snmptrapd[1581]: 2013-03-08 17:07:52 x.x.x.x(via UDP: [x.x.x.x]:15065->[x.x.x.x]) TRAP, SNMP v1, community br0u#012#011enterprises.14685.3.3.2 Enterprise Specific Trap (1) Uptime: 2:2:19:54.43#012#011enterprises.14685.3.3.1.1.0 71#011enterprises.14685.3.3.1.2.0 4#011enterprises.14685.3.3.1.3.0 "Fri Mar 08 2013 16:07:51"#011enterprises.14685.3.3.1.5.0 enterprises.14685.3.2.55#011enterprises.14685.3.3.1.6.0 "xxx"#011enterprises.14685.3.3.1.7.0 3518401#011enterprises.14685.3.3.1.4.0 "xxx"#011enterprises.14685.3.3.1.8.0 "xxx"#011enterprises.14685.3.3.1.9.0 "0x80e00160"
regex=snmptrapd\[(\d+)]:+.+via UDP: \[([\d\.]+)\]:+.+011enterprises.14685.3.3.1.1.0 (\d+)+.+011enterprises.14685.3.3.1.2.0 [1,2,3,4]+.+011enterprises.14685.3.3.1.6.0 "([\S ]+|\S+)"+.+011enterprises.14685.3.3.1.7.0 (\d+)+.+011enterprises.14685.3.3.1.4.0 "([\S ]+|\S+)"+.+011enterprises.14685.3.3.1.8.0 "(\S+)"+.+011enterprises.14685.3.3.1.9.0 "(\S+)"; \
 classification.text=$6 - $4; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=ibm_id; \
 classification.reference(0).name=$8; \
 classification.reference(0).url=http://www.ibm.com; \
 id=7001; \
 revision=1; \
 analyzer(0).name=DPW; \
 analyzer(0).manufacturer=IBM; \
 analyzer(0).class=Firewall XML; \
 analyzer(0).node.name=$2; \
 assessment.impact.severity=high; \
 assessment.impact.description=This event was generated by the XML Firewall of IBM.; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=n/a; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$7; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Category:; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Level:; \
 additional_data(1).data=Emerg - Error.; \
 additional_data(2).type=string; \
 additional_data(2).meaning=tid:; \
 additional_data(2).data=$5; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Object Name:; \
 additional_data(3).data=$4; \
 additional_data(4).type=string; \
 additional_data(4).meaning=Domain:; \
 additional_data(4).data=$7; \
 additional_data(5).type=string; \
 additional_data(5).meaning=Events Codes:; \
 additional_data(5).data=http://publib.boulder.ibm.com/infocenter/wsdatap/v4r0m2/index.jsp?topic=%2Fcom.ibm.dp.doc%2Fmessages03.htm; \
 last

#DESCRIPTION:Event generated by the XML Firewall of IBM (Medium impact)
#CATEGORY:Network Security
regex=snmptrapd\[(\d+)]:+.+via UDP: \[([\d\.]+)\]:+.+011enterprises.14685.3.3.1.1.0 (\d+)+.+011enterprises.14685.3.3.1.2.0 [5,6]+.+011enterprises.14685.3.3.1.6.0 "([\S ]+|\S+)"+.+011enterprises.14685.3.3.1.7.0 (\d+)+.+011enterprises.14685.3.3.1.4.0 "([\S ]+|\S+)"+.+011enterprises.14685.3.3.1.8.0 "(\S+)"+.+011enterprises.14685.3.3.1.9.0 "(\S+)"; \
 classification.text=$6 - $4; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=ibm_id; \
 classification.reference(0).name=$8; \
 classification.reference(0).url=http://www.ibm.com; \
 id=7002; \
 revision=1; \
 analyzer(0).name=DPW; \
 analyzer(0).manufacturer=IBM; \
 analyzer(0).class=Firewall XML; \
 analyzer(0).node.name=$2; \
 assessment.impact.severity=medium; \
 assessment.impact.description=This event was generated by the XML Firewall of IBM.; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=n/a; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$7; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Category:; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Level:; \
 additional_data(1).data=Emerg - Error.; \
 additional_data(2).type=string; \
 additional_data(2).meaning=tid:; \
 additional_data(2).data=$5; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Object Name:; \
 additional_data(3).data=$4; \
 additional_data(4).type=string; \
 additional_data(4).meaning=Domain:; \
 additional_data(4).data=$7; \
 additional_data(5).type=string; \
 additional_data(5).meaning=Events Codes:; \
 additional_data(5).data=http://publib.boulder.ibm.com/infocenter/wsdatap/v4r0m2/index.jsp?topic=%2Fcom.ibm.dp.doc%2Fmessages03.htm; \
 last

#DESCRIPTION:Event generated by the XML Firewall of IBM (Low impact)
#CATEGORY:Network Security
regex=snmptrapd\[(\d+)]:+.+via UDP: \[([\d\.]+)\]:+.+011enterprises.14685.3.3.1.1.0 (\d+)+.+011enterprises.14685.3.3.1.2.0 [7,8]+.+011enterprises.14685.3.3.1.6.0 "([\S ]+|\S+)"+.+011enterprises.14685.3.3.1.7.0 (\d+)+.+011enterprises.14685.3.3.1.4.0 "([\S ]+|\S+)"+.+011enterprises.14685.3.3.1.8.0 "(\S+)"+.+011enterprises.14685.3.3.1.9.0 "(\S+)"; \
 classification.text=$6 - $4; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=ibm_id; \
 classification.reference(0).name=$8; \
 classification.reference(0).url=http://www.ibm.com; \
 id=7003; \
 revision=1; \
 analyzer(0).name=DPW; \
 analyzer(0).manufacturer=IBM; \
 analyzer(0).class=Firewall XML; \
 analyzer(0).node.name=$2; \
 assessment.impact.severity=low; \
 assessment.impact.description=This event was generated by the XML Firewall of IBM.; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=n/a; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$7; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Category:; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Level:; \
 additional_data(1).data=Emerg - Error.; \
 additional_data(2).type=string; \
 additional_data(2).meaning=tid:; \
 additional_data(2).data=$5; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Object Name:; \
 additional_data(3).data=$4; \
 additional_data(4).type=string; \
 additional_data(4).meaning=Domain:; \
 additional_data(4).data=$7; \
 additional_data(5).type=string; \
 additional_data(5).meaning=Events Codes:; \
 additional_data(5).data=http://publib.boulder.ibm.com/infocenter/wsdatap/v4r0m2/index.jsp?topic=%2Fcom.ibm.dp.doc%2Fmessages03.htm; \
 last

#DESCRIPTION:Event generated by the XML Firewall of IBM (High impact)
#CATEGORY:Network Security
#LOG:Mar  6 15:56:34 prelude-siem snmptrapd[4314]: 2013-03-06 15:56:24 x.x.x.x(via UDP: [x.x.x.x]:52075->[x.x.x.x]) TRAP, SNMP v1, community br0u#012#011enterprises.14685.3.3.2 Enterprise Specific Trap (2) Uptime: 0:0:58:50.57#012#011enterprises.14685.3.3.1.1.0 254#011enterprises.14685.3.3.1.2.0 8#011enterprises.14685.3.3.1.3.0 "Wed Mar 06 2013 14:46:48"#011enterprises.14685.3.3.1.7.0 815#011enterprises.14685.3.3.1.4.0 "xxx"#011enterprises.14685.3.3.1.8.0 "xxx"#011enterprises.14685.3.3.1.9.0 "0x80e006e0"
regex=snmptrapd\[(\d+)]:+.+via UDP: \[([\d\.]+)\]:+.+011enterprises.14685.3.3.1.1.0 (\d+)+.+011enterprises.14685.3.3.1.2.0 [1,2,3,4]+.+011enterprises.14685.3.3.1.7.0 (\d+)+.+011enterprises.14685.3.3.1.4.0 "([\S ]+|\S+)"+.+011enterprises.14685.3.3.1.8.0 "(\S+)"+.+011enterprises.14685.3.3.1.9.0 "(\S+)"; \
 classification.text=$5; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=ibm_id; \
 classification.reference(0).name=$7; \
 classification.reference(0).url=http://www.ibm.com; \
 id=7004; \
 revision=1; \
 analyzer(0).name=DPW; \
 analyzer(0).manufacturer=IBM; \
 analyzer(0).class=Firewall XML; \
 analyzer(0).node.name=$2; \
 assessment.impact.severity=high; \
 assessment.impact.description=This event was generated by the XML Firewall of IBM.; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=n/a; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$6; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Category:; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Level:; \
 additional_data(1).data=Emerg - Error.; \
 additional_data(2).type=string; \
 additional_data(2).meaning=tid:; \
 additional_data(2).data=$4; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Domain:; \
 additional_data(3).data=$6; \
 additional_data(4).type=string; \
 additional_data(4).meaning=Events Codes:; \
 additional_data(4).data=http://publib.boulder.ibm.com/infocenter/wsdatap/v4r0m2/index.jsp?topic=%2Fcom.ibm.dp.doc%2Fmessages03.htm; \
 last

#DESCRIPTION:Event generated by the XML Firewall of IBM (Medium impact)
#CATEGORY:Network Security
regex=snmptrapd\[(\d+)]:+.+via UDP: \[([\d\.]+)\]:+.+011enterprises.14685.3.3.1.1.0 (\d+)+.+011enterprises.14685.3.3.1.2.0 [5,6]+.+011enterprises.14685.3.3.1.7.0 (\d+)+.+011enterprises.14685.3.3.1.4.0 "([\S ]+|\S+)"+.+011enterprises.14685.3.3.1.8.0 "(\S+)"+.+011enterprises.14685.3.3.1.9.0 "(\S+)"; \
 classification.text=$5; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=ibm_id; \
 classification.reference(0).name=$7; \
 classification.reference(0).url=http://www.ibm.com; \
 id=7005; \
 revision=1; \
 analyzer(0).name=DPW; \
 analyzer(0).manufacturer=IBM; \
 analyzer(0).class=Firewall XML; \
 analyzer(0).node.name=$2; \
 assessment.impact.severity=medium; \
 assessment.impact.description=This event was generated by the XML Firewall of IBM.; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=n/a; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$6; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Category:; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Level:; \
 additional_data(1).data=Warn - Notice.; \
 additional_data(2).type=string; \
 additional_data(2).meaning=tid:; \
 additional_data(2).data=$4; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Domain:; \
 additional_data(3).data=$6; \
 additional_data(4).type=string; \
 additional_data(4).meaning=Events Codes:; \
 additional_data(4).data=http://publib.boulder.ibm.com/infocenter/wsdatap/v4r0m2/index.jsp?topic=%2Fcom.ibm.dp.doc%2Fmessages03.htm; \
 last

#DESCRIPTION:Event generated by the XML Firewall of IBM (Low impact)
#CATEGORY:Network Security
regex=snmptrapd\[(\d+)]:+.+via UDP: \[([\d\.]+)\]:+.+011enterprises.14685.3.3.1.1.0 (\d+)+.+011enterprises.14685.3.3.1.2.0 [7,8]+.+011enterprises.14685.3.3.1.7.0 (\d+)+.+011enterprises.14685.3.3.1.4.0 "([\S ]+|\S+)"+.+011enterprises.14685.3.3.1.8.0 "(\S+)"+.+011enterprises.14685.3.3.1.9.0 "(\S+)"; \
 classification.text=$5; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=ibm_id; \
 classification.reference(0).name=$7; \
 classification.reference(0).url=http://www.ibm.com; \
 id=7006; \
 revision=1; \
 analyzer(0).name=DPW; \
 analyzer(0).manufacturer=IBM; \
 analyzer(0).class=Firewall XML; \
 analyzer(0).node.name=$2; \
 assessment.impact.severity=low; \
 assessment.impact.description=This event was generated by the XML Firewall of IBM.; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=n/a; \
 target(0).node.address(0).category=ipv4-addr; \
 target(0).node.address(0).address=$6; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Category:; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Level:; \
 additional_data(1).data=Info - Debug.; \
 additional_data(2).type=string; \
 additional_data(2).meaning=tid:; \
 additional_data(2).data=$4; \
 additional_data(3).type=string; \
 additional_data(3).meaning=Domain:; \
 additional_data(3).data=$6; \
 additional_data(4).type=string; \
 additional_data(4).meaning=Events Codes:; \
 additional_data(4).data=http://publib.boulder.ibm.com/infocenter/wsdatap/v4r0m2/index.jsp?topic=%2Fcom.ibm.dp.doc%2Fmessages03.htm; \
 last