Decoder HPE Alletra and HPE Primera
Kobrik Kobrikovic
I manage to decode everything after timestamp and hostname in batches. But I need the timestamp and hostname for further processing of the ruleset.
Log:
Jul 11 14:29:38 3PAR_XZ123456SV new_obj sw_user_conn:11374:10.100.0.103:55555:jiri.novak User Connection 11374(10.1.1.10:55555:jiri.novak) added
Decoders:
<decoder name="alletra">
<prematch>new_obj</prematch>
</decoder>
<decoder name="alletra">
<parent>alletra</parent>
<regex>(\w+ \d+ \d+:\d+:\d+) ([^^s]+) new_obj (\w+)</regex>
<order>timestamp,hostname,program,action</order>
</decoder>
<decoder name="alletra">
<parent>alletra</parent>
<regex> (\w+) new_obj</regex>
<order>system_hostname</order>
</decoder>
<decoder name="alletra">
<parent>alletra</parent>
<regex>new_obj (\w+)</regex>
<order>action</order>
</decoder>
<decoder name="alletra">
<parent>alletra</parent>
<regex>sw_user_conn:(\w+):(\S+):(\S+):(\S+)</regex>
<order>action_id,srcip,srcport,username</order>
</decoder>
Md. Nazmur Sakib
Hi Kobrik Kobrikovic, There are two phases of decoding. The input log first goes through the pre-decoding phase, during which general information, such as a timestamp, a hostname, and a program name, are extracted when a Syslog-like header is present.
In the decoding phase, the decoder extracts information from the remaining log. In this example, the decoder only analyzes the message: new_obj sw_user_conn:30854:127.0.0.1:45794:bohdan.danek User Connection 30854(127.0.0.1:45794:bohdan.danek) added'
I have written a sample decoder to test it.
<decoder name="alletra">
<prematch>new_obj</prematch>
</decoder>
<decoder name="alletra">
<parent>alletra</parent>
<regex>^(\.+)$</regex>
<order>log</order>
</decoder>
So it is not possible to grip the hostname in the decoding phase and use it in a rule.
Alternatively, if you are using localfile to forward these logs to Wazuh you can add some additional value at the start of the log.
<localfile>
<log_format>syslog</log_format>
<location>/var/log/log.log</location>
<out_format target="custom_socket">alletra log: $(log)</out_format>
</localfile>
After this, the log format will be changed to this
alletra log: Jul 11 14:29:38 3PAR_XZ123456SV new_obj sw_user_conn:11374:10.100.0.103:55555:jiri.novak User Connection 11374(10.1.1.10:55555:jiri.novak) added
and will not go to the pre-decoding phase.
Now you will be able to use those values in the decoder and rules.
Let me know if you need any furter assistance on this.