Unable to create decoder and rules for Aruba AP Logs

[Rajat Patel]

I am trying to create decoder for below given logs type of Aruba AP:

Jul 20 16:47:36 2026 10.7.2.19 cli[6005]: <341004> <WARN> AP:HRD_GF-:cc:ff:3c_Master <10.7.2.19 A8:5B:F7:CC:FF:3C>  AP 10.7.2.15: Client 5a:5a:84:2d:39:56 authenticate fail because RADIUS server authentication failure

Jul 20 16:42:55 2026 10.7.2.19 stm[6041]: <501094> <NOTI> AP:HRD_GF-:cc:ff:3c_Master <10.7.2.19 A8:5B:F7:CC:FF:33>  Auth failure: d6:a5:17:db:81:42: AP 10.7.2.19-a8:5b:f7:4f:f3:c0-HRD_GF-:cc:ff:3c_Master Reason Client Match

Jul 20 16:28:17 2026 10.7.2.9 stm[6061]: <501094> <NOTI> AP:NB_SF_BDD:cd:16:b6 <10.7.2.9 A8:5B:F7:CD:16:B1>  Auth failure: cc:47:40:59:e3:c8: AP 10.7.2.9-a8:5b:f7:51:6b:72-NB_SF_BDD:cd:16:b6 Reason Invalid PMKID

Jul 20 10:27:00 2026 10.7.2.6 stm[6136]: <501094> <NOTI> AP:NB_FF_FIN:cc:e9:96 <10.7.2.6 A8:5B:F7:CC:E9:69>  Auth failure: 60:e3:2b:b8:20:b3: AP 10.7.2.6-a8:5b:f7:4e:99:72-NB_FF_FIN:cc:e9:96 Reason R0KH unreachable

Jul 20 09:29:39 2026 10.7.2.22 stm[6180]: <501094> <NOTI> AP:NBSFBDD_2 <10.7.2.22 CC:88:C7:C6:D9:AA>  Auth failure: 08:f9:7e:95:d6:a9: AP 10.7.2.22-cc:88:c7:ed:9a:f2-NBSFBDD_2 Reason WPA2 IE missing

Jul 20 11:14:34 2026 10.7.2.17 stm[5943]: <501094> <NOTI> AP:GF_REC_P7:cc:e8:6e <10.7.2.17 A8:5B:F7:CC:E8:66>  Auth failure: cc:47:40:5c:0b:98: AP 10.7.2.17-a8:5b:f7:4e:86:f2-GF_REC_P7:cc:e8:6e Reason WPA2 IE missing

Jul 20 10:18:41 2026 10.7.2.15 stm[6144]: <501094> <NOTI> AP:OB SF a8:5b:f7:cc:e4:b2 <10.7.2.15 A8:5B:F7:CC:E4:B9>  Auth failure: 7c:b0:c2:1e:51:f9: AP 10.7.2.15-a8:5b:f7:4e:4b:32-OB SF a8:5b:f7:cc:e4:b2 Reason WPA2 IE missing

So, please help with it and provide decoder and rule for these types of logs

[Olamilekan Abdullateef Ajani]

Hello, 

I made sample decoders and rules to help with the logs you shared, the logs were grouped in two based on their format, you can inspect them below:


<decoder name="aruba-wireless">
  <prematch type="pcre2">\d{1,3}(?:\.\d{1,3}){3}\s+(?:cli|stm)\[\d+\]:</prematch>
</decoder>


<decoder name="aruba-wireless-cli">
  <parent>aruba-wireless</parent>
   <prematch type="pcre2">cli\[\d+\]:\s+\x3c\d+\x3e\s+\x3c[A-Z]+\x3e</prematch>
  <regex type="pcre2">(\d{1,3}(?:\.\d{1,3}){3})\s+cli\[(\d+)\]:\s+\x3c(\d+)\x3e\s+\x3c(\w+)\x3e\s+AP:(.+?)\s+\x3c(\d{1,3}(?:\.\d{1,3}){3})\s+([0-9A-Fa-f:]{17})\x3e\s+AP\s+(\d{1,3}(?:\.\d{1,3}){3}):\s+Client\s+([0-9A-Fa-f:]{17})\s+(authenticate fail)\s+because\s+(.+)$</regex>

  <order>controller_ip,process_id,event_id,log_level,ap_name,device_ip,device_mac,ap_ip,client_mac,action,reason</order>
</decoder>

<decoder name="aruba-wireless-stm">
  <parent>aruba-wireless</parent>

  <prematch type="pcre2">stm\[\d+\]:\s+\x3c501094\x3e\s+\x3cNOTI\x3e</prematch>

  <regex type="pcre2">(\d{1,3}(?:\.\d{1,3}){3})\s+stm\[(\d+)\]:\s+\x3c(\d+)\x3e\s+\x3c([^>]+)\x3e\s+AP:(.+?)\s+\x3c(\d{1,3}(?:\.\d{1,3}){3})\s+([0-9A-Fa-f:]{17})\x3e\s+Auth failure:\s+([0-9A-Fa-f:]{17}):\s+AP\s+(.+)\s+Reason\s+(.+)$</regex>

  <order>controller_ip,process_id,event_id,log_level,ap_name,device_ip,device_mac,client_mac,ap_reference,reason</order>
</decoder>

Rules

<group name="aruba,wireless,authentication,">

  <rule id="110700" level="8">
    <decoded_as>aruba-wireless</decoded_as>
    <field name="event_id">^341004$</field>
    <description>Wireless client $(client_mac) authentication failed on AP $(ap_name). Reason: $(reason)</description>
  </rule>

  <rule id="110701" level="7">
    <decoded_as>aruba-wireless</decoded_as>
    <field name="event_id">^501094$</field>
    <description>Wireless client $(client_mac) authentication failed on AP $(ap_name). Reason: $(reason)</description>
  </rule>

</group>

You can also refer to the attached image for result. If you need further assistance on this, you can also refer to the decoder and rule documentation below. Please let me know if you have further questions.

Ref:
https://wazuh.com/blog/creating-decoders-and-rules-from-scratch/
https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/decoders.html
https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rules.html