Feeding DShield with OSSEC Logs
Today, I'd like to promote a tool that I wrote four years ago and that is running every 30 minutes on my OSSEC server. DShield offers many clients to collect and process logs from multiple firewall brands/vendors. But today, more and more logs are already centralized to a SIEM. Collecting the events twice can be a pain for performance, complexity and security reasons. I'm collecting firewall logs from many devices with OSSEC so there are stored in a central place. The idea of ossec2dshield is to read the logs from OSSEC and forward them to DShield. Writing a DShield agent is easy, everything is described here. Basically, the script parses the OSSEC's firewall.log and generates the corresponding DShield events.
The script syntax is self-explanatory:
$ ossec2dshield.pl --log=file --userid=dshieldid --statefile=file --from=email --mta=hostname [--help] [--debug] [--test] [--obfuscate] [--ports=port1,port2,...] Where: --help : This help --debug : Display processing details to stdout --test : Test only, do not mail the info to dshield.org --obfuscate : Obfuscate the destination address (10.x.x.x) --ports=port1,!port2,... : Filter destination ports ex: !25,!80,445,53 --log=file : Your OSSEC firewall.log --userid=dshieldid : Your dshield.org UserID (see http://www.dshield.org) --statefile=file : File to write the state of log processing --from=email : Your e-mail address (From:) --mta=hostname : Your Mail Transfer Agent (to send mail to dshield.org)
You will need your dshield.org UserID, a mail relay (MTA). The state file is very important: it contains the timestamp of the last processed event. This prevents events to be sent twice to dshield.org. Once processed, the data will be submitted to register(at)dshield(dot)org. Using “–-port“, you can exclude or restrict to some interesting ports. Example: “–-port=’!80,!22,!443′” will report all blocked firewall traffic except for the destination ports 80, 22 and 443. The current version of the script is not so powerful as the regular Dshield clients but it works very well. Ideas and suggestions are always welcome. The script is available in my github.com repository. Happy logging!
Xavier Mertens
ISC Handler - Freelance Security Consultant
rootshell.be
truesec.be
Reverse-Engineering Malware: Advanced Code Analysis | Singapore | Nov 18th - Nov 22nd 2024 |
Comments
Anonymous
Sep 11th 2015
9 years ago
- Centralization of log files
- Creation of security rules that triggers notifications or actions
- FIM
- Rootkit detection
- Active-Response (ex: temporary block an attacker's IP address)
About your question: Yes, Windows is supported (only agents - the servers MUST run on UNIX). Ping me off-list if you want to discuss about OSSEC!
Anonymous
Sep 11th 2015
9 years ago
@Xme, apologies for hijacking your thread.
Anonymous
Sep 11th 2015
9 years ago
Anonymous
Sep 11th 2015
9 years ago
[--obfusctate]
seems to be misspelled. Might confuse someone who is using this tool, especially people who (like me) like to copy/paste in order to avoid typos...
Anonymous
Sep 13th 2015
9 years ago
Anonymous
Sep 14th 2015
9 years ago