/etc/octopussy/conf/services/Cisco_Pix.xml is in octopussy 1.0.6-0ubuntu1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 | <?xml version='1.0' encoding='UTF-8'?>
<octopussy_service description="Cisco Pix Service"
icon="companies/logo_cisco"
name="Cisco_Pix"
nb_messages="005"
version="201110310002">
<message loglevel="Notice"
msg_id="Cisco_Pix:url_access"
pattern="<@DATE_TIME_ISO:datetime@> <@WORD:device@> <@DATE_TIME_ISO:datetime_long@>: <@REGEXP(".*\%PIX-.+"):msg_id@>: <@WORD:pix_addr@> <@REGEXP("Accessed"):status@> URL <@WORD:url@>"
rank="001"
table="Cisco_Pix_url_access"
taxonomy="Traffic" />
<message loglevel="Warning"
msg_id="Cisco_Pix:deny_by_accessgroup"
pattern="<@DATE_TIME_ISO:datetime@> <@WORD:device@> <@DATE_TIME_ISO:datetime_long@>: <@REGEXP(".*\%PIX-.+"):msg_id@>: Deny <@WORD:type@> src <@WORD:src@> dst <@STRING:dst@> by access-group "<@WORD:acl@>""
rank="002"
table="Cisco_Pix_traffic"
taxonomy="Traffic.Denied" />
<message loglevel="Notice"
msg_id="Cisco_Pix:url_access2"
pattern="<@DATE_TIME_ISO:datetime@> <@WORD:device@> <@REGEXP(".*\%PIX-.+"):msg_id@>: <@WORD:pix_addr@> <@REGEXP("Accessed"):status@> URL <@WORD:url@>"
rank="003"
table="Cisco_Pix_url_access"
taxonomy="Traffic" />
<message loglevel="Warning"
msg_id="Cisco_Pix:deny_by_accessgroup2"
pattern="<@DATE_TIME_ISO:datetime@> <@WORD:device@> <@REGEXP(".*\%PIX-.+"):msg_id@>: Deny <@WORD:type@> src <@WORD:src@> dst <@STRING:dst@> by access-group "<@WORD:acl@>""
rank="004"
table="Cisco_Pix_traffic"
taxonomy="Traffic.Denied" />
<message loglevel="Information"
msg_id="Cisco_Pix:denied_icmp"
pattern="<@DATE_TIME_ISO:datetime@> <@WORD:device@> <@REGEXP(".*\%PIX-.+"):msg_id@>: Denied <@REGEXP("ICMP type=\d+"):type@>, <@STRING:NULL@> from <@WORD:src@> on interface <@NUMBER:NULL@>"
rank="005"
table="Cisco_Pix_traffic"
taxonomy="Traffic.Denied" />
</octopussy_service>
|