paulmataruso/main
1
0
Fork 0
mirror of https://github.com/socfortress/Wazuh-Rules.git synced 2025-10-23 00:02:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create maltrail_decoders.xml

Browse Source
This commit is contained in:
taylor_socfortress
2023-03-23 07:05:08 -05:00
committed by GitHub
parent 13a0ff9147
commit 220bc35b3e
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
Maltrail/maltrail_decoders.xml Normal file
View File

@@ -0,0 +1,24 @@
<!--
- Maltrail decoder
- Author: Michael Muenz, Julián Morales
- Updated by Wazuh, Inc.
- Copyright (C) 2015-2022, Wazuh Inc.
- Copyright (C) 2009 Trend Micro Inc.
- This program is a free software; you can redistribute it and/or modify it under the terms of GPLv2.
-->
<!--
- Will extract the srcip, srcport, dstip and dstport and also trail and category.
- Examples: Dec 23 14:55:34 OPNsense.localdomain CEF: 0|Maltrail|sensor|0.26.1|2020-12-23|long domain (suspicious)
|0|src=172.24.68.133 spt=55989 dst=8.8.8.8 dpt=53 trail=(q6pmisvlqpgxptq1s6psghvyoqali.uribl).rspamd.com ref=(heuristic)
-->
<decoder name="CEF">
<program_name>^CEF$</program_name>
</decoder>
<decoder name="CEF">
<parent>CEF</parent>
<regex>(\w+)\|(\w+)\|(\w+)\|(\.+)\|(\d+-\d+-\d+)\|(\.+)\|(\d+)\|src=(\d+.\d+.\d+.\d+) spt=(\.+) dst=(\d+.\d+.\d+.\d+) dpt=(\.+) trail=(\.+) ref=(\.+)</regex>
<order>code, application, type, version, date, category, severity, srcip, srcport, dstip, dstport, trail, ref</order>
</decoder>