[ossec-list] src_ip and dst_ip 0.0.0.0

[Николай Сеньков]

Hello,

In ossec agent log for same host (PDS2) alert for different event is not
resolved srcip in ip or asset name

AV - Alert - "1542351904" --> RID: "5715"; RL: "3"; RG:
"syslog,sshd,authentication_success,"; RC: "SSHD authentication success.";
USER: "oracle"; SRCIP:"172.20.191.17"; HOSTNAME: "pds2"; LOCATION:
"/var/log/auth.log"; EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]:
Accepted publickey for oracle from 172.20.191.17 port 61956 ssh2[END]";

AV - Alert - "1542351904" --> RID: "5501"; RL: "3"; RG:
"pam,syslog,authentication_success,"; RC: "Login session opened."; USER:
"None"; SRCIP: "None"; HOSTNAME: "pds2"; LOCATION: "/var/log/auth.log";
EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]: pam_unix(sshd:session):
session opened for user oracle by (uid=0)[END]";

2018-11-16 00:05:02,134 Detector [WARNING]: ssh[4003] Event's field dst_ip
pds2 is not a valid IP.v4/IP.v6 address, falling back to default: 0.0.0.0

2018-11-16 00:05:02,135 Detector [WARNING]: ssh[4003] Event's device field
pds2 is not a valid IP.v4/IP.v6 address, falling back to default local.

[dan (ddp)]

On Fri, Nov 16, 2018 at 4:12 AM Николай Сеньков

Post by Николай Сеньков
Hello,
In ossec agent log for same host (PDS2) alert for different event is not resolved srcip in ip or asset name
AV - Alert - "1542351904" --> RID: "5715"; RL: "3"; RG: "syslog,sshd,authentication_success,"; RC: "SSHD authentication success."; USER: "oracle"; SRCIP:"172.20.191.17"; HOSTNAME: "pds2"; LOCATION: "/var/log/auth.log"; EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]: Accepted publickey for oracle from 172.20.191.17 port 61956 ssh2[END]";

This one looks like it's parsing properly.,

Post by Николай Сеньков
AV - Alert - "1542351904" --> RID: "5501"; RL: "3"; RG: "pam,syslog,authentication_success,"; RC: "Login session opened."; USER: "None"; SRCIP: "None"; HOSTNAME: "pds2"; LOCATION: "/var/log/auth.log"; EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]: pam_unix(sshd:session): session opened for user oracle by (uid=0)[END]";

This one has no IP to parse, although there is a user.

Adding this after the pam decoder seems to work for me (but I haven't
made sure nothing else breaks):
<decoder name="pam-ssh">
<parent>pam</parent>
<prematch>^pam_unix\(sshd:\w+\): </prematch>
<regex offset="after_prematch">^session \w+ for user (\S+) </regex>
<order>user</order>
</decoder>

Post by Николай Сеньков
2018-11-16 00:05:02,134 Detector [WARNING]: ssh[4003] Event's field dst_ip pds2 is not a valid IP.v4/IP.v6 address, falling back to default: 0.0.0.0
2018-11-16 00:05:02,135 Detector [WARNING]: ssh[4003] Event's device field pds2 is not a valid IP.v4/IP.v6 address, falling back to default local.

There's no decoder for these at all. What are the log messages from?

Post by Николай Сеньков
--
---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
For more options, visit https://groups.google.com/d/optout.