Collect OSSEC logs

This document describes how you can collect OSSEC logs by configuring OSSEC and a Google Security Operations forwarder. This document also lists the supported log types and supported OSSEC version.

For more information, see Data ingestion to Google Security Operations.

Overview

The following deployment architecture diagram shows how OSSEC agents and servers are configured to send logs to Google Security Operations. Each customer deployment might differ from this representation and might be more complex.

Deployment architecture

The architecture diagram shows the following components:

  • Linux system. The Linux system to be monitored. The Linux system conists of the files to monitor and the OSSEC agent.

  • Microsoft Windows system. The Microsoft Windows system to be monitored in which the OSSEC agent is installed.

  • OSSEC agent. The OSSEC agent collects information from the Microsoft Windows or Linux system and forwards the information to the OSSEC server.

  • OSSEC server. The OSSEC server monitors and receives information from the OSSEC agents. analyzes the logs, and forwards the logs to the Google Security Operations forwarder.

  • Google Security Operations forwarder. The Google Security Operations forwarder is a lightweight software component, deployed in the customer's network, that supports syslog. The Google Security Operations forwarder forwards the logs to Google Security Operations.

  • Google Security Operations. Google Security Operations retains and analyzes the logs from the OSSEC server.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the OSSEC ingestion label.

Before you begin

  • Ensure that the OSSEC agent is installed on the Microsoft Windows or Linux systems that you plan to monitor. For more information about installing OSSEC agent, see OSSEC installation

  • Use a OSSEC version that the Google Security Operations parser supports. The Google Security Operations parser supports OSSEC version 3.6.0.

  • Ensure that the OSSEC server is installed and configured on the central Linux server.

  • Verify the log types that the Google Security Operations parser supports. The following table list the products and log file paths that the Google Security Operations parser supports:

    Operating system Product Log file path
    Microsoft Windows Microsoft Windows Event logs
    Linux Linux /var/log/audit/audit.log
    Linux Linux /var/log/syslog
    Linux Linux /var/log/ulog/syslogemu.log
    Linux apache2 /var/log/apache2/access.log
    Linux apache2 /var/log/apache2/error.log
    Linux apache2 /var/log/apache2/other_vhosts_access.log
    Linux apache2 /var/log/apache2/novnc-server-access.log
    Linux OpenVpn /var/log/openvpnas.log
    Linux Nginx /var/log/nginx/access.log
    Linux Nginx /var/log/nginx/error.log
    Linux rkhunter /var/log/rkhunter.log
    Linux - OSSEC Server OSSEC /var/ossec/logs/ossec.log
    Linux Linux /var/log/auth.log
    Linux Linux /var/log/kern.log
    Linux rundeck /var/log/rundeck/rundeck.api.log
    Linux rundeck /var/log/rundeck/service.log
    Linux Samba /var/log/samba/log.winbindd
    Linux Linux /var/log/mail.log

  • Ensure that all systems in the deployment architecture are configured in the UTC time zone.

Configure OSSEC agent and server, and Google Security Operations forwarder

To configure OSSEC agent and server, and the Google Security Operations forwarder, do the following:

  1. To monitor the logs that the Linux systems generate, create an ossec.conf file to specify the log monitoring configuration for the agent. Here is an example configuration file for the agent on the Linux system:

    <ossec_config>

<!-- Files to monitor (localfiles) -->
<localfile>
 <log_format>syslog</log_format>
 <location>/var/ossec/logs/ossec.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/auth.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/kern.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/mail.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/syslog</location>
</localfile>

<localfile>
 <log_format>apache</log_format>
 <location>/var/log/apache2/error.log</location>
</localfile>

<localfile>
 <log_format>apache</log_format>
 <location>/var/log/apache2/access.log</location>
</localfile>

<localfile>
 <log_format>apache</log_format>
 <location>/var/log/apache2/other_vhost_access.log</location>
</localfile>

<localfile>
 <log_format>apache</log_format>
 <location>/var/log/apache2/nonvnc-server-access.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/nginx/access.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/nginx/error.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/openvpnas.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/rkhunter.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/rundeck/service.log</location>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/samba/log.winbindd</location>
</localfile>

<localfile>
 <log_format>command</log_format>
 <command>df -P</command>
</localfile>

<localfile>
 <log_format>syslog</log_format>
 <location>/var/log/audit/audit.log</location>
</localfile>

<localfile>
 <log_format>full_command</log_format>
 <command>netstat -tan |grep LISTEN |egrep -v '(192.0.2.1| ::1)' | sort</command>
</localfile>

<localfile>
 <log_format>full_command</log_format>
 <command>last -n 5</command>
</localfile>
</ossec_config>

  2. To monitor the logs that the Microsoft Windows systems generate, create an ossec.conf file to specify the log monitoring configuration for the agent. Here is an example configuration file for the agent on the Microsoft Windows system:

    <ossec_config>
<!-- Channels to monitor (localfiles) -->
<localfile>
 <log_format>Security</log_format>
 <location>eventchannel</location>
</localfile>

<localfile>
 <log_format>System</log_format>
 <location>eventchannel</location>
</localfile>

<localfile>
 <log_format>Application</log_format>
 <location>eventchannel</location>
</localfile>
</ossec_config>

  3. To forward the logs from the OSSEC server to Google Security Operations using the syslog protocol, create the syslog.conf OSSEC server configuration file in the following format:

    .*.@<CHRONICLE_FORWARDER_IP>:<CHRONICLE_FORWARDER_PORT>

  4. Configure the Google Security Operations forwarder to send logs to Google Security Operations. For more information, see Installing and configuring the forwarder on Linux. The following is an example of a Google Security Operations forwarder configuration:

      - syslog:
      common:
        enabled: true
        data_type: OSSEC
        batch_n_seconds: 10
        batch_n_bytes: 1048576
      tcp_address: 0.0.0.0:10514
      connection_timeout_sec: 60

Field mapping reference

This section explains how the Google Security Operations parser applies grok patterns for Linux and Microsoft Windows systems and how it maps OSSEC log fields to Google Security Operations Unified Data Model (UDM) fields for each log type.

For information about mapping reference of common fields, see Common fields

For reference information about log paths, grok patterns for example logs, event types, and UDM fields on Linux systems, refer to the following sections:

For information about supported Microsoft Windows events and the corresponding UDM fields, see Microsoft Windows events data

Common fields

The following table lists the common log fields and their corresponding UDM fields.

Common log field UDM field
collected_time metadata.collected_timestamp
application principal.application
log metadata.description
ip target.ip or principal.ip
hostname target.hostname or principal.hostname

Linux system

The following table lists the log paths for Linux system, grok pattern for example logs, event type, and UDM mappings:

Log path Example log Grok pattern Event type UDM mapping
/var/log/apache2/error.log [Thu Apr 28 16:13:01.283342 2022] [core:notice] [pid 18394:tid 140188660751296] [client 1.200.32.47:59840] failed to make connection [{timestamp}][{log_module}:{log_level}][pid{pid}(<optional_field>:tid{tid}|)](<optional_field> [client {client_ip}:{client_port}]|) (?<error_message>.*) NETWORK_UNCATEGORIZED

timestamp is mapped to metadata.event_timestamp

log_module is mapped to target.resource.name

log_level is mapped to security_result.severity

pid is mapped to target.process.parent_process.pid

tid is mapped to target.process.pid

client_ip is mapped to principal.ip

client_port is mapped to principal.port

error_message is mapped to security_result.description

network.application_protocol is set to "HTTP"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

/var/log/apache2/error.log [Thu Apr 28 16:13:01.283342 2022] [core:notice] [pid 18394:tid 140188660751296] failed to make connection [{timestamp}][{log_module}:{severity}][pid{pid}(<optional_field>:tid{tid}|)]{error_message} NETWORK_UNCATEGORIZED

timestamp is mapped to metadata.event_timestamp

log_module is mapped to target.resource.name

log_level is mapped to security_result.severity

pid is mapped to target.process.parent_process.pid

tid is mapped to target.process.pid

error_message is mapped to security_result.description

network.application_protocol is set to "HTTP"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

/var/log/apache2/error.log [Thu Apr 28 16:13:01.283342 2022] [core:notice] [pid 18394:tid 140188660751296] AH00094: Command line: '/usr/sbin/apache2' [{timestamp}][{log_module}:{log_level}][pid{pid}(<optional_field>:tid{tid}|)](<optional_field> [client {client_ip}:{client_port}]|) (?<error_message>.*),referer{referer_url} NETWORK_UNCATEGORIZED

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

timestamp is mapped to metadata.event_timestamp

log_module is mapped to target.resource.name

log_level is mapped to security_result.severity

pid is mapped to target.process.parent_process.pid

tid is mapped to target.process.pid

client_ip is mapped to principal.ip

client_port is mapped to principal.port

error_message is mapped to security_result.description

target.platform is set to "LINUX"

referer_url is mapped to network.http.referral_url

/var/log/apache2/error.log Sun Jan 30 15:14:47.260309 2022] [proxy_http:error] [pid 12515:tid 140035781285632] [client 1.200.32.47:59840] AH01114: HTTP: failed to make connection to backend: 192.0.2.1 , referer altostrat.com [{timestamp}] [{log_module}:{log_level}] [pid {pid}(<optional_field>:tid{tid}|)] [client {client_ip}:{client_port}]( <message_text>HTTP: )?{error_message}:( {target_ip})(<optional_field>,referer{referer_url})?" NETWORK_HTTP

timestamp is mapped to metadata.event_timestamp

log_module is mapped to target.resource.name

log_level is mapped to security_result.severity

pid is mapped to target.process.parent_process.pid

tid is mapped to target.process.pid

client_ip is mapped to principal.ip

client_port is mapped to principal.port

error_message is mapped to security_result.description

target_ip is mapped to target.ip

referer_url is mapped to network.http.referral_url

network.application_protocol is set to "HTTP"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

/var/log/apache2/error.log [Sat Feb 02 00:30:55 2019] New connection: [connection: gTxkX8Z6tjk] [client 192.0.2.1:50786] [{timestamp}]<message_text>connection:[connection:{connection_id}][client{client_ip}:{client_port}] NETWORK_UNCATEGORIZED

timestamp is mapped to metadata.event_timestamp

client_ip is mapped to principal.ip

client_port is mapped to principal.port

connection_id is mapped to network.session_id

network.application_protocol is set to "HTTP"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

/var/log/apache2/error.log [Sat Feb 02 00:30:55 2019] New request: [connection: j8BjX4Z5tjk] [request: ACtkX1Z5tjk] [pid 8] [client 192.0.2.1:50784] [{timestamp}]<message_text>request:[connection:{connection_id}][request:{request_id}][pid{pid}][client{client_ip}:{client_port}] NETWORK_UNCATEGORIZED

timestamp is mapped to metadata.event_timestamp

request_id is mapped to security_result.detection_fields.(key/value)

client_ip is mapped to principal.ip

client_port is mapped to principal.port

pid is mapped to target.process.parent_process.pid

connection_id is mapped to network.session_id

network.application_protocol is set to "HTTP"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

/var/log/apache2/error.log [Sat Feb 02 00:30:55 2019] [info] [C: j8BjX4Z5tjk] [R: p7pjX4Z5tjk] [pid 8] core.c(4739): [client 192.0.2.1:50784] AH00128: File does not exist: /usr/local/apache2/htdocs/favicon.ico [{timestamp}] [{log_level}][C:{connection_id}][R:{request_id}][pid {pid}(<optional_field>:tid{tid}|)]<message_text>[client {client_ip}:{client_port}]{error_message}:{file_path} NETWORK_UNCATEGORIZED

timestamp is mapped to metadata.event_timestamp

log_level is mapped to security_result.severity

request_id is mapped to security_result.detection_fields.(key/value)

client_ip is mapped to principal.ip

client_port is mapped to principal.port

pid is mapped to target.process.parent_process.pid

connection_id is mapped to network.session_id

error_message is mapped to security_result.description

file_path is mapped to target.file.full_path

network.application_protocol is set to "HTTP"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

/var/log/apache2/access.log 10.50.0.1 - - [28/Apr/2022:18:02:13 +0530] "POST /test/first.html HTTP/1.1" 200 491 "http://192.0.2.1/test/first.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" ({client_ip})?<message_text>{userid}[{timestamp}](<optional_field>{method}/(<optional_field>{resource}?) {client_protocol}?){result_status}{object_size}(<optional_field>(<optional_field>{referer_url}?)(<optional_field>{user_agent}?)? NETWORK_HTTP

client_ip is mapped to principal.ip

userid is mapped to principal.user.userid

host is mapped to principal.hostname

timestamp is mapped to metadata.event_timestamp

method is mapped to network.http.method

resource is mapped to principal.resource.name

client_protocol is mapped to network.application_protocol

result_status is mapped to network.http.response_code

object_size is mapped to network.sent_bytes

referer_url is mapped to network.http.referral_url

user_agent is mapped to network.http.user_agent

network.ip_protocol is set to "TCP"

network.direction is set to "OUTBOUND"

network.application_protocol is set to "HTTP"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

var/log/apache2/other_vhosts_access.log wintest.example.com:80 ::1 - - [14/Jan/2022:14:08:16 -0700] \"GET /server-status?auto HTTP/1.1\" 200 1415 \"-\" \"Python-urllib/2.7\" {target_host}:{NUMBER:target_port} {client_ip} - (<optional_field>{host}?) [{timestamp}](<optional_field>{method}/(<optional_field>{resource}?){client_protocol}?){result_status}{object_size}(<optional_field>{referer_url}?)(<optional_field>{user_agent}?) NETWORK_HTTP

target_host is mapped to target.hostname

target_port is mapped to target.port

client_ip is mapped to principal.ip

userid is mapped to principal.user.userid

host is mapped to principal.hostname

timestamp is mapped to metadata.event_timestamp

method is mapped to network.http.method

resource is mapped to principal.resource.name

result_status is mapped to network.http.response_code

object_size is mapped to network.sent_bytes

referer_url is mapped to network.http.referral_url

user_agent is mapped to network.http.user_agent

network.ip_protocol is set to "TCP"

network.direction is set to "OUTBOUND"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

network.application_protocol is set to "HTTP"

/var/log/apache2/access.log "http://192.0.2.1/test/first.html" -> /altostrat.com (<optional_field>{referer_url}?)->(<optional_field>{path}?) GENERIC_EVENT

path is mapped to target.url

referer_url is mapped to network.http.referral_url

network.direction is set to "OUTBOUND"

target.platform is set to "LINUX"

network.application_protocol is set to "HTTP"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

/var/log/apache2/access.log Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Code/1.67.0 Chrome/98.0.4758.141 Electron/17.4.1 Safari/537.36 (<optional_field>{user_agent}) GENERIC_EVENT

user_agent is mapped to network.http.user_agent

network.direction is set to "OUTBOUND"

target.platform is set to "LINUX"

network.application_protocol is set to "HTTP"

target.platform is set to "LINUX"

metadata.vendor_name is set to "Apache"

metadata.product_name is set to "Apache HTTP Server"

var/log/nginx/access.log 172.16.19.228 - admin [05/May/2022:11:53:27 +0530] "GET /icons/ubuntu-logo.png HTTP/1.1" 404 209 "http://192.0.2.1/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36" {principal_ip} - (<optional_field>{principal_user_userid}?) [{timestamp}] {http_method} /(<optional_field>{resource_name}?|) {protocol}(<message_text>){response_code} {received_bytes}(<optional_field>{referer_url}) ({user_agent}|{user_agent})? NETWORK_HTTP

time is mapped to metadata.timestamp

ip is mapped to target.ip

principal_ip is mapped to principal.ip

principal_user_userid is mapped to principal.user.userid

metadata_timestamp is mapped to timestamp

http_method is mapped to network.http.method

resource_name is mapped to principal.resource.name

protocol is mapped to network.application_protocol = (HTTP)

response_code is mapped to network.http.response_code

received_bytes is mapped to network.sent_bytes

referer_url is mapped to network.http.referral_url

user_agent is mapped to network.http.user_agent

target.platform is set to "LINUX"

metadata.vendor_name is set to "NGINX"

metadata.product_name is set to "NGINX"

network.ip_protocol is set to "TCP"

network.direction is set to "OUTBOUND"

var/log/nginx/error.log 2022/01/29 13:51:48 [error] 593#593: *62432 open() \"/usr/share/nginx/html/nginx_status\" failed (2: No such file or directory), client: 192.0.2.1, server: localhost, request: \"GET /nginx_status HTTP/1.1\", host: \"192.0.2.1:8080\" "{year}\/{month}\/{day}{time}[{severity}]{pid}#{thread_id}:{inner_message2}"

inner_message2 is mapped to "{security_result_description_2},client:{principal_ip},server:(<optional_field>{target_hostname}?),request:"{http_method} /(<optional_field>{resource_name}?) {protocol}/1.1",host:"({target_ip}:{target_port})?"

"bind() to ({target_ip}|[{target_ip}]):{target_port} failed ({security_description})",

"\*{cid}{security_description}",

"{security_description}"

NETWORK_HTTP

thread_id is mapped to principal.process.pid

severity is mapped to security_result.severity

(debug is mapped to UNKNOWN_SEVERITY, info is mapped to INFORMATIONAL, notice is mapped to LOW, warn is mapped to MEDIUM, error is mapped to ERROR, crit is mapped to CRITICAL, alert is mapped to HIGH)

target_file_full_path is mapped to target.file.full_path

principal_ip is mapped to principal.ip

target_hostname is mapped to target.hostname

http_method is mapped to network.http.method

resource_name is mapped to principal.resource.name

protocol is mapped to "TCP"

target_ip is mapped to target.ip

target_port is mapped to target.port

security_description + security_result_description_2 is mapped to security_result.description

pid is mapped to principal.process.parent_process.pid

network.application_protocol is set to "HTTP"

timestamp is mapped to %{year}/%{day}/%{month} %{time}

target.platform is set to "LINUX"

metadata.vendor_name is set to "NGINX"

metadata.product_name is set to "NGINX"

network.ip_protocol is set to "TCP"

network.direction is set to "OUTBOUND"

var/log/rkhunter.log [14:10:40] Required commands check failed [<message_text>]{security_description} STATUS_UPDATE

time is mapped to metadata.timestamp

securtiy_description is mapped to security_result.description

principal.platform is set to "LINUX"

metadata.vendor_name is set to "RootKit Hunter"

metadata.product_name is set to "RootKit Hunter"

var/log/rkhunter.log [14:09:52] Checking for file '/dev/.oz/.nap/rkit/terror' [ Not found ] [<message_text>] {security_description} {file_path}[{metadata_description}] FILE_UNCATEGORIZED

metadata_description is mapped to metadata.description

file_path is mapped to target.file.full_path

security_description is mapped to security_result.description

principal.platform is set to "LINUX"

metadata.vendor_name is set to "RootKit Hunter"

metadata.product_name is set to "RootKit Hunter"

var/log/rkhunter.log ossec: File size reduced (inode remained): '/var/log/rkhunter.log'. (<optional_field><message_text>:){metadata_description}:'{file_path}' FILE_UNCATEGORIZED

time is mapped to metadata.timestamp

metadata_description is mapped to metadata.description

file_path is mapped to target.file.full_path

principal.platform is set to "LINUX"

metadata.vendor_name is set to "RootKit Hunter"

metadata.product_name is set to "RootKit Hunter"

/var/log/kern.log Jul 7 18:48:32 zynvpnsvr kernel: [2081387.006876] IPv4: martian source 1.20.32.39 from 192.0.2.1, on dev as0t5 {timestamp}{principal_hostname}{metadata_product_event_type}: [<message_text>?] <message_text>?{target_ip}\from{principal_ip}, on dev {target_user_userid} NETWORK_CONNECTION timestamp is mapped to "metadata.event_timestamp"

principal_hostname is mapped to "principal.hostname"

metadata_product_event_type is mapped to "metadata.product_event_type"

target_ip is mapped to "target.ip"

principal_ip is mapped to "principal.ip"

target_user_userid is mapped to "target.user.userid"

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

/var/log/kern.log Oct 25 10:10:51 localhost kernel: [ 31.974576] audit: type=1400 audit(1635136846.152:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/lxc-start" pid=752 {timestamp}{principal_hostname}{metadata_product_event_type}: <message_text>\operation="{metadata_description}"\profile="<message_text>"\name="{file_path}"\pid={pid} STATUS_UPDATE timestamp is mapped to "metadata.event_timestamp"

principal_hostname is mapped to "principal.hostname"

metadata_product_event_type is mapped to "metadata.product_event_type"

metadata_description is mapped to "metadata.description"

file_path is mapped to "principal.process.file"

pid is mapped to "principal.process.pid"

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

/var/log/kern.log Apr 28 12:41:35 localhost kernel: [ 5079.912215] ctnetlink v0.93: registering with nfnetlink. {timestamp}{principal_hostname}{metadata_product_event_type}:[<message_text>?]{metadata_description} STATUS_UPDATE timestamp is mapped to "metadata.event_timestamp"

principal_hostname is mapped to "principal.hostname"

metadata_product_event_type is mapped to "metadata.product_event_type"

metadata_description is mapped to "metadata.description"

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

/var/log/kern.log Apr 28 11:17:01 localhost kernel: [ 0.030139] smpboot: CPU0: Intel(R) Xeon(R) Gold 5220R CPU @ 2.20GHz (family: 0x6, model: 0x55, stepping: 0x7) {timestamp}{principal_hostname}{metadata_product_event_type}:([<message_text>])<message_text>:\CPU0:{principal_asset_hardware_cpu_model}({metadata_description}) STATUS_UPDATE timestamp is mapped to "metadata.event_timestamp"

principal_hostname is mapped to "principal.hostname"

metadata_product_event_type is mapped to "metadata.product_event_type"

principal_asset_hardware_cpu_model is mapped to "principal.asset.hardware.cpu_model"

metadata_description is mapped to "metadata.description"

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

cpu_model is mapped to principal.asset.hardware.cpu_model

/var/log/syslog.log Jan 29 13:51:46 winevt env[29194]: [29/Jan/2022:13:51:46] REQUES GET 200 /api/systems/0000-0041 (10.0.1.1) 3179 {collected_timestamp}{hostname}{command_line}[{pid}]:[{date}<message_text>]REQUES{http_method}{response_code}(<optional_field>{resource}?)({target_ip}){received_bytes} NETWORK_CONNECTION

collected_time is mapped to metadata.event_timestamp

hostname is mapped to principal.hostname

pid is mapped to principal.process.pid

http_method is mapped to network.http.method

response_code is mapped to network.http.response_code

resource is mapped to target.url

target_ip is mapped to target.ip

received_bytes is mapped to network.received_bytes

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

command_line is mapped to principal.process.command_line

/var/log/syslog.log Jul 26 23:13:03 zynossec ossec-authd[1096]: 2021/07/26 23:13:03 ossec-authd: INFO: Received request for a new agent (zsecmgr0000-0719) from: 3.4.5.6 {collected_timestamp}<message_text>{command_line}[{pid}]:{date} {time} {command_line}:{log_level}:{message}({hostname})from: {target_ip} STATUS_UPDATE

collected_time is mapped to metadata.event_timestamp

hostname is mapped to principal.hostname

pid is mapped to principal.process.pid

log_level is mapped to security_result.severity

message is mapped to metadata.description

command_line is mapped to principal.process.command_line

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

target_ip is mapped to target.ip

/var/log/syslog.log Jul 26 23:13:03 zynossec ossec-authd[1096]: 2021/07/26 23:13:03 ossec-authd: INFO: New connection from 3.4.5.6 {collected_time}{hostname}{command_line}[{pid}]:{date} {time} {command_line}:{log_level}:{description}from {target_ip} STATUS_UPDATE

collected_time is mapped to metadata.event_timestamp

hostname is mapped to principal.hostname

pid is mapped to principal.process.pid

log_level is mapped to security_result.severity

description is mapped to security_result.description

command_line is mapped to principal.process.command_line

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

/var/log/syslog.log Jan 29 13:51:46 zynossec ossec-authd[1096]: 2021/07/26 23:13:03 ossec-authd: ERROR: Invalid agent name zsecmgr0000-0719 (duplicated) {collected_timestamp}<message_text>{command_line}[{pid}]:{date}<message_text>:{log_level}:{description}{hostname}({reason}) STATUS_UPDATE

collected_time is mapped to metadata.event_timestamp

hostname is mapped to principal.hostname

pid is mapped to principal.process.pid

log_level is mapped to security_result.severity

description + reason is mapped to security_result.description

command_line is mapped to principal.process.command_line

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

/var/log/syslog.log May 2 06:25:01 localhost apachectl[64942]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using ::1. Set the 'ServerName' directive globally to suppress this message {collected_timestamp}{hostname}{command_line}(<optional_field>|[{pid}]):{message} STATUS_UPDATE

collected_time is mapped to metadata.event_timestamp

hostname is mapped to principal.hostname

pid is mapped to principal.process.pid

message is mapped to metadata.description

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

command_line is mapped to principal.process.command_line

/var/log/syslog.log May 2 00:00:45 localhost fstrim[64727]: /: 6.7 GiB (7205015552 bytes) trimmed {collected_timestamp}{hostname}{command_line}(<optional_field>|[{pid}]):{message} STATUS_UPDATE

collected_time is mapped to metadata.event_timestamp

hostname is mapped to principal.hostname

pid is mapped to principal.process.pid

message is mapped to metadata.description

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

command_line is mapped to principal.process.command_line

/var/log/syslog.log May 3 10:14:37 localhost rsyslogd: rsyslogd's userid changed to 102 {collected_timestamp}{hostname}{command_line}:{message}to{user_id} STATUS_UPDATE

collected_time is mapped to metadata.collected_timestamp

hostname is mapped to principal.hostname

message is mapped to metadata.description

user_id is mapped to principal.user.userid

command_line is mapped to principal.process.command_line

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

/var/log/syslog.log May 5 10:36:48 localhost systemd[1]: Starting System Logging Service... {collected_timestamp}{hostname}{command_line}(<optional_field>|[{pid}]):{message} STATUS_UPDATE

collected_time is mapped to metadata.event_timestamp

hostname is mapped to principal.hostname

pid is mapped to principal.process.pid

message is mapped to metadata.description

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

command_line is mapped to principal.process.command_line

/var/log/mail.log Mar 16 11:40:56 Ubuntu18 sendmail[9341]: 22G6AtwH009341: from=<ossecm@Ubuntu18>, size=377, class=0, nrcpts=1, metadata_descriptionid=<202203160610.22G6AtwH009341@Ubuntu18.cdsys.local>, proto=SMTP, daemon=MTA-v4, relay=localhost [192.0.2.1] {timestamp} {target_hostname} {application}[{pid}]: <message_text>:{KV} STATUS_UPDATE

target_hostname is mapped to target.hostname

application is mapped to target.application

pid is mapped to target.process.pid

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/mail.log Apr 7 13:44:01 prod postfix/pickup[22580]: AE4271627DB: uid=0 from=<root> {timestamp} {target_hostname} {application}[{pid}]: <message_text>{KV} EMAIL_UNCATEGORIZED

target_hostname is mapped to target.hostname

application is mapped to target.application

pid is mapped to target.process.pid

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/mail.log Apr 7 13:44:01 prod postfix/cleanup[23434]: AE4271627DB: message-id=<20150207184401.AE4271627DB@server.hostname.01> {timestamp} {target_hostname} {application}[{pid}]: <message_text> message-id=<{resource_name}> STATUS_UPDATE

target_hostname is mapped to target.hostname

application is mapped to target.application

pid is mapped to target.process.pid

resource_name is mapped to target.resource.name

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/mail.log Apr 7 13:44:01 prod postfix/qmgr[3539]: AE4271627DB: from=<root@server.hostname.01>, size=565, nrcpt=1 (queue active) {timestamp} {target_hostname} {application}[{pid}]: <message_text>{KV} EMAIL_UNCATEGORIZED

target_hostname is mapped to target.hostname

application is mapped to target.application

pid is mapped to target.process.pid

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/mail.log Apr 7 13:44:01 prod postfix/smtp[23436]: connect to gmail-smtp-in.l.google.com[2607:f8b0:400d:c03::1b]:25: Network is unreachable {timestamp} {target_hostname} {application}[{pid}]: <message_text>{KV} STATUS_UPDATE

target_hostname is mapped to target.hostname

application is mapped to target.application

pid is mapped to target.process.pid

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/mail.log Apr 7 13:44:02 prod postfix/local[23439]: E62521627DC: to=<root@server.hostname.01>, relay=local, delay=0.01, delays=0/0.01/0/0, dsn=2.0.0, status=sent (delivered to mailbox) {timestamp} {target_hostname} {application}[{pid}]: <message_text>{KV} EMAIL_UNCATEGORIZED

target_hostname is mapped to target.hostname

application is mapped to target.application

pid is mapped to target.process.pid

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/rundeck/service.log [2022-05-04T17:03:11,166] WARN config.NavigableMap - Accessing config key '[filterNames]' through dot notation is deprecated, and it will be removed in a future release. Use 'config.getProperty(key, targetClass)' instead. [{timestamp}]{severity}{summary}\-{security_description}

, at {command_line}\({file_path}:<message_text>\)

STATUS_UPDATE

command_line is mapped to "target.process.command_line"

file_path is mapped to "target.process.file.full_path"

timestamp is mapped to "metadata.event_timestamp"

severity is mapped to "security_result.severity"

summary is mapped to "security_result.summary"

security_description is mapped to "security_result.description"

metadata.product_name is set to "OSSEC"

metadata.vendor_name is set to "OSSEC"

/var/log/auth.log Apr 27 21:03:03 Ubuntu18 systemd-logind[836]: Removed session 3080. {timestamp} {principal_hostname}{principal_application}(<optional_field>[{pid}]):{security_description}{network_session_id}?(of user{principal_user_userid})? USER_LOGOUT

timestamp is mapped to "metadata.timestamp"

If metadata.event_type is USER_LOGOUT, then principal_hostname is mapped to "target.hostname" else it is mapped to "principal.hostname".

If metadata.event_type is USER_LOGOUT, then principal_application is mapped to "target.application" else it is mapped to "principal.application".

If metadata.event_type is USER_LOGOUT, then pid is mapped to "target.process.pid" else it is mapped to "principal.process.pid".

security_description is mapped to "security_result.description"

network_session_id is mapped to "network.session_id"

If metadata.event_type is USER_LOGOUT, principal_user_userid is mapped to "principal.user.userid" else it is mapped to "target.user.userid".

"principal.platform" is mapped to "LINUX"

if(removed_session) event_type is set to USER_LOGOUT

extensions.auth.type is set to AUTHTYPE_UNSPECIFIED

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/auth.log Apr 28 11:33:24 Ubuntu18 systemd-logind[836]: New session 3205 of user root. {timestamp} {principal_hostname}{principal_application}(<optional_field>[{pid}]):{security_description}{network_session_id}?(of user{principal_user_userid})? USER_LOGIN

timestamp is mapped to "metadata.timestamp"

If metadata.event_type is USER_LOGOUT, then principal_hostname is mapped to "target.hostname" else it is mapped to "principal.hostname".

If metadata.event_type is USER_LOGOUT, then principal_application is mapped to "target.application" else it is mapped to "principal.application".

If metadata.event_type is USER_LOGOUT, then pid is mapped to "target.process.pid" else it is mapped to "principal.process.pid".

security_description is mapped to "security_result.description"

network_session_id is mapped to "network.session_id"

If metadata.event_type is USER_LOGOUT, principal_user_userid is mapped to "principal.user.userid" else it is mapped to "target.user.userid".

"principal.platform" is mapped to "LINUX"

"network.application_protocol" is mapped to "SSH"

if(new_session) event_type is set to USER_LOGIN

extensions.auth.type is set to AUTHTYPE_UNSPECIFIED

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/auth.log Apr 28 11:35:31 Ubuntu18 sshd[23573]: Accepted password for root from 10.0.1.1 port 40503 ssh2 {timestamp} {principal_hostname}{principal_application}(<optional_field>[{pid}])<optional_field> {security_description} for (invalid user )?{principal_user_userid} from {principal_ip} port {principal_port} ssh2(:{security_result_detection_fileds_ssh_kv}SHA256:{security_result_detection_fileds_kv})? USER_LOGIN

timestamp is mapped to "metadata.timestamp"

If metadata.event_type is USER_LOGOUT, then principal_hostname is mapped to "target.hostname" else it is mapped to "principal.hostname".

If metadata.event_type is USER_LOGOUT, then principal_application is mapped to "target.application" else it is mapped to "principal.application".

If metadata.event_type is USER_LOGOUT, then pid is mapped to "target.process.pid" else it is mapped to "principal.process.pid".

security_description is mapped to "security_result.description"

If metadata.event_type is USER_LOGOUT, principal_user_userid is mapped to "principal.user.userid" else it is mapped to "target.user.userid".

principal_ip is mapped to "principal.ip"

principal_port is mapped to "principal.port"

security_result_detection_fields_ssh_kv is mapped to "security_result.detection_fields.key/value"

security_result_detection_fields_kv is mapped to "security_result.detection_fields.key/value"

"principal.platform" is set to "LINUX"

"network.application_protocol" is set to "SSH"

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/auth.log Apr 28 11:50:20 Ubuntu18 sshd[24145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.1.1 user=root {timestamp} {principal_hostname}{principal_application}([{pid}])<optional_field> <message_text>: {security_description};logname=(<message_text>)?uid=({principal_user_userid})?euid=({principal_user_attribute_labels_euid_kv})?tty=(<message_text>)?ruser=({principal_ruser_userid})?rhost=({target_ip})?(user=(<optional_field>{principal_user_userid}|{principal_user_userid})?)? USER_LOGIN

timestamp is mapped to "metadata.timestamp"

If metadata.event_type is USER_LOGOUT, then principal_hostname is mapped to "target.hostname" else it is mapped to "principal.hostname".

If metadata.event_type is USER_LOGOUT, then principal_application is mapped to "target.application" else it is mapped to "principal.application".

If metadata.event_type is USER_LOGOUT, then pid is mapped to "target.process.pid" else it is mapped to "principal.process.pid".

security_description is mapped to "security_result.description"

principal_user_uuserid is mapped to "principal.user.attribute.labels"

principal_user_attribute_labels_euid_kv is mapped to "principal.user.attribute.labels.key/value"

principal_ruser_userid is mapped to "principal.user.attribute.labels.key/value"

target_ip is mapped to "target.ip"

If metadata.event_type is is USER_LOGOUT, then principal_user_userid is mapped to "principal.user.userid" else it is mapped to "target.user.userid"

"principal.platform" is set to "LINUX"

"network.application_protocol" is set to "SSH"

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/auth.log Feb 24 00:13:02 precise32 sudo: tsg : user NOT in sudoers ; TTY=pts/1 ; PWD=/home/vagrant ; USER=root ; COMMAND=/bin/ls {timestamp} {principal_hostname}{principal_application}(<optional_field>[{pid}])<optional_field> {principal_user_userid} :( {security_description} ;)? TTY=<message_text> ; PWD={principal_process_command_line_1} ; USER={principal_user_attribute_labels_uid_kv} ; COMMAND={principal_process_command_line_2} STATUS_UPDATE

timestamp is mapped to metadata.timestamp

principal_hostname is mapped to principal.hostname

principal_application is mapped to principal.application

pid is mapped to principal.process.pid

principal_user_userid is mapped to target.user.userid

security_description is mapped to "security_result.description"

principal_process_command_line_1 is mapped to "principal.process.command_line"

principal_process_command_line_2 is mapped to "principal.process.command_line"

principal_user_attribute_labels_uid_kv is mapped to "principal.user.attribute.labels.key/value"

"principal.platform" is set to "LINUX"

/var/log/auth.log Apr 26 07:39:01 Ubuntu18 CRON[2126]: pam_unix(cron:session): session opened for user root by (uid=0) {timestamp} {principal_hostname}{principal_application}(<optional_field>[{pid}])<optional_field> {security_description} for (invalid user|user)?{principal_user_userid}(by (uid={principal_user_attribute_labels_uid_kv}))?$ USER_LOGIN

timestamp is mapped to metadata.timestamp

If metadata.event_type is USER_LOGOUT, then principal_hostname is mapped to "target.hostname" else it is mapped to "principal.hostname".

If metadata.event_type is USER_LOGOUT, then principal_application is mapped to "target.application" else it is mapped to "principal.application".

If metadata.event_type is USER_LOGOUT, then pid is mapped to "target.process.pid" else it is mapped to "principal.process.pid".

security_description is mapped to "security_result.description"

If metadata.event_type is USER_LOGOUT, principal_user_userid is mapped to "principal.user.userid" else it is mapped to "target.user.userid".

principal_user_attribute_labels_uid_kv is mapped to "principal.user.attribute.labels.key/value"

"principal.platform" is set to "LINUX"

"network.application_protocol" is set to "SSH"

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/auth.log Apr 26 07:39:01 Ubuntu18 CRON[2126]: pam_unix(cron:session): session closed for user root {timestamp} {principal_hostname}{principal_application}(<optional_field>[{pid}])<optional_field> {security_description} for (invalid user|user)?{principal_user_userid}(by (uid={principal_user_attribute_labels_uid_kv}))?$ USER_LOGOUT

timestamp is mapped to metadata.timestamp

If metadata.event_type is USER_LOGOUT, then principal_hostname is mapped to "target.hostname" else it is mapped to "principal.hostname".

If metadata.event_type is USER_LOGOUT, then principal_application is mapped to "target.application" else it is mapped to "principal.application".

If metadata.event_type is USER_LOGOUT, then pid is mapped to "target.process.pid" else it is mapped to "principal.process.pid".

security_description is mapped to "security_result.description"

If metadata.event_type is USER_LOGOUT, principal_user_userid is mapped to "principal.user.userid" else it is mapped to "target.user.userid".

principal_user_attribute_labels_uid_kv is mapped to principal.user.attribute.labels.key/value

"principal.platform" is set to "LINUX"

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

/var/log/auth.log May 24 12:56:31 ip-10-50-2-176 sshd[119931]: Timeout, client not responding. {timestamp} {principal_hostname}{principal_application}([{pid}])<optional_field> {security_result_description} STATUS_UPDATE

timestamp is mapped to metadata.timestamp

principal_hostname is mapped to principal.hostname

principal_application is mapped to principal.application

pid is mapped to principal.process.pid

security_result_description is mapped to security_result_description

"principal.platform" is set to "LINUX"

metadata.vendor_name is set to OSSEC

metadata.product_name is set to OSSEC

var/log/samba/log.winbindd [2022/05/05 13:51:22.212484, 0] ../source3/winbindd/winbindd_cache.c:3170(initialize_winbindd_cache)initialize_winbindd_cache: clearing cache and re-creating with version number 2 {timestamp},{severity}(<optional_field>,pid={pid},effective({principal_user_attribute_labels_kv},{principal_group_attribute_labels_kv}),real({principal_user_userid},{principal_group_product_object_id}))?]<message_text>:{security_description} STATUS_UPDATE

timestamp is mapped to "metadata.timestamp"

pid is mapped to "principal.process.pid"

principal_user_attribute_labels_kv is mapped to "principal.user.attribute.labels"

principal_group_attribute_labels_kv is mapped to "principal.group.attribute.labels"

principal_user_userid is mapped to "principal.user.userid"

principal_group_product_object_id is mapped to "principal.group.product_object_id"

security_description is mapped to "security_result.description"

metadata_description is mapped to "metadata.description"

metadata.product_name is set to "OSSEC"

"metadata.vendor_name" is set to "OSSEC"

var/log/samba/log.winbindd messaging_dgm_init: bind failed: No space left on device {user_id}: {desc} STATUS_UPDATE

metadata.product_name is set to "OSSEC"

metadata.vendor_name" is set to "OSSEC"

user_id is mapped to principal.user.userid

desc is mapped to metadata.description

var/log/openvpnas.log 2022-04-29T10:51:22+0530 [stdout#info] [OVPN 4] OUT: '2022-04-29 05:21:22 mohit_AUTOLOGIN/10.50.0.1:16245 MULTI: Learn: 172.27.232.2 -> mohit_AUTOLOGIN/10.50.0.1:16245' {timestamp}[stdout#{log_level}][OVPN <message_text>]OUT:(<optional_field>'|")<message_text>-<message_text>{user}\/{ip}:{port}MULTI:Learn:{local_ip}->{target_hostname}?{target_ip}:{port}(<optional_field>'|") NETWORK_HTTP

timestamp is mapped to metadata.timestamp

log_level is mapped to security_result.severity

local_ip is mapped to principal.ip

target_ip is mapped to target.ip

target_hostname is mapped to principal.hostname

port is mapped to target.port

user is mapped to principal.user.user_display_name

metadata.vendor_name is set to "OpenVPN"

metadata.product_name is set to "OpenVPN Access Server"

principal.platform is set to "LINUX"

var/log/openvpnas.log 2022-04-28T16:14:13+0530 [stdout#info] [OVPN 6] OUT: '2022-04-28 16:14:13 library versions: OpenSSL 1.1.1 11 Sep 2018, LZO 2.08' {timestamp}[stdout#{log_level}][OVPN <message_text>]OUT:(<optional_field>'|")<message_text>{msg}(<optional_field>'|") STATUS_UPDATE

timestamp is mapped to metadata.timestamp

log_level is mapped to security_result.severity

msg is mapped to security_result.description

metadata.vendor_name is set to "OpenVPN"

metadata.product_name is set to "OpenVPN Access Server"

principal.platform is set to "LINUX"

var/log/openvpnas.log 2022-04-29T10:51:22+0530 [stdout#info] [OVPN 4] OUT: '2022-04-29 05:21:22 10.50.0.1:16245 [mohit_AUTOLOGIN] Peer Connection Initiated with [AF_INET]10.50.0.1:16245 (via [AF_INET]10.50.2.175%ens160)' {timestamp}[stdout#{log_level}][OVPN <message_text>]OUT:(<optional_field>'|")<message_text>{message}(<optional_field>'|")

message is mapped to <message_text>with[<message_text>]<message_text>:{port}<message_text>

STATUS_UPDATE

timestamp is mapped to metadata.timestamp

log_level is mapped to security_result.severity

message is mapped to security_result.description

metadata.vendor_name is set to "OpenVPN"

metadata.product_name is set to "OpenVPN Access Server"

principal.platform is set to "LINUX"

var/log/openvpnas.log 2022-04-29T10:51:22+0530 [stdout#info] [OVPN 4] OUT: "2022-04-29 05:21:22 mohit_AUTOLOGIN/10.50.0.1:16245 SENT CONTROL [mohit_AUTOLOGIN]: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,redirect-gateway def1,redirect-gateway bypass-dhcp,redirect-gateway autolocal,route-gateway 172.27.232.1,dhcp-option DNS 10.0.1.99,dhcp-option DNS 10.0.1.94,register-dns,block-ipv6,ifconfig 172.27.232.2 255.255.254.0,peer-id 0,auth-tokenSESS_ID,cipher AES-256-GCM,key-derivation tls-ekm' (status=1)" {timestamp}[stdout#{log_level}][OVPN <message_text>]OUT:(<optional_field>'|")<message_text>{user}\/{ip}:{message}(<optional_field>'|") STATUS_UPDATE

timestamp is mapped to metadata.timestamp

log_level is mapped to security_result.severity

message is mapped to security_result.description

user is mapped to principal.user.user_display_name

ip is mapped to principal.ip

metadata.vendor_name is set to "OpenVPN"

metadata.product_name is set to "OpenVPN Access Server"

principal.platform is set to "LINUX"

var/log/openvpnas.log 2022-04-29T10:51:22+0530 [stdout#info] AUTH SUCCESS {'status': 0, 'user': 'mohit', 'reason': 'AuthAutoLogin: autologin certificate auth succeeded', 'proplist': {'prop_autogenerate': 'true', 'prop_autologin': 'true', 'pvt_password_digest': '[redacted]', 'type': 'user_connect'}, 'common_name': 'mohit_AUTOLOGIN', 'serial': '3', 'serial_list': []} cli='win'/'3.git::d3f8b18b'/'OCWindows_3.3.6-2752' {timestamp}[stdout#{log_level}]{summary}{'<message_text>':({status})?'<message_text>':({user})?'<message_text>':({reason})?<message_text>}, 'common_name':'{user_name}'<message_text>}cli='{cli}' STATUS_UPDATE

timestamp is mapped to metadata.timestamp

log_level is mapped to security_result.severity

message is mapped to security_result.description

summary is mapped to security_result.summary

user_name is mapped to principal.user.user_display_name

cli is mapped to principal.process.command_line

status is mapped to principal.user.user_authentication_status

metadata.vendor_name is set to "OpenVPN"

metadata.product_name is set to "OpenVPN Access Server"

principal.platform is set to "LINUX"

/var/log/audit.log type=SYSTEM_RUNLEVEL metadata_description=audit(1651576133.423:202): pid=1571 uid=0 auid=4294967295 ses=4294967295 metadata_description='old-level=N new-level=5 comm="systemd-update-utmp" exe="/lib/systemd/systemd-update-utmp" hostname=? addr=? terminal=? res=success' type={audit_log_type}=audit((<optional_field>{metadata_ingested_timestamp}|{metadata_ingested_timestamp})<message_text>:<message_text>):{audit_message} EventType in current sheet Audit log EventType mapping tab audit_log_type is mapped to metadata.product_event_type

metadata_ingested_timestamp is mapped to "metadata.event_timestamp"

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.plateform is set to "LINUX"

data is mapped to key value pair-> UDM mapping in current sheet audit.log tab

var/ossec/logs/ossec.log 2022/05/12 18:15:34 ossec-syscheckd: INFO: Starting syscheck scan {timestamp} {application}(({pid}))<optional_field>{severity}:{metadata_description} STATUS_UPDATE

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

metadata_description is mapped to metadata.description

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

var/ossec/logs/ossec.log 2022/05/11 19:34:27 ossec-logcollector: INFO: Monitoring full output of command(360): last -n 5 {timestamp} {application}(({pid}))<optional_field>{severity}:(?<metadata_description>.*command.*(<message_text>)):{command_line} PROCESS_UNCATEGORIZED

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

command_line is mapped to target.process.command_line

metadata_description is mapped to metadata.description

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

var/ossec/logs/ossec.log 2022/05/11 19:34:27 ossec-analysisd(1210): ERROR: Queue '/queue/alerts/ar' not accessible: 'Connection refused'. {timestamp} {application}(({pid}))<optional_field>{severity}: Queue '{resource}'<message_text>:'{metadata_description}' USER_RESOURCE_ACCESS

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

metadata_description is mapped to metadata.description

resource is mapped to target.resource.name

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

var/ossec/logs/ossec.log 2022/05/11 19:34:27 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/rundeck/rundeck.log'. {timestamp} {application}(({pid}))<optional_field>{severity}:(?<metadata_description><message_tewxt>file<message_text>):'{file_path}' FILE_UNCATEGORIZED

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

file_path is mapped to target.file.full_path

metadata_description is mapped to metadata.description

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

var/ossec/logs/ossec.log 2022/05/11 19:34:25 ossec-syscheckd: INFO: ignoring: 'C:\WINDOWS/PCHEALTH/HELPCTR/DataColl' {timestamp} {application}(({pid}))<optional_field>{severity}:<message_text>ignoring<message_text>:'{file_path}' SCAN_PROCESS

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

file_path is mapped to target.file.full_path

metadata.vendor_name is set to OSSEC

metadata.product_name is set to OSSEC

var/ossec/logs/ossec.log 2022/05/11 19:34:21 ossec-remoted(1410): INFO: Reading authentication keys file. {timestamp} {application}(({pid}))<optional_field>{severity}:{metadata_description} STATUS_UPDATE

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

metadata_description is mapped to metadata.description

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

var/ossec/logs/ossec.log 2022/05/11 19:34:21 ossec-remoted(1103): ERROR: Could not open file '/queue/rids/004' due to [(13)-(Permission denied)]. {timestamp} {application}(({pid}))<optional_field>{severity}:(?<metadata_description><message_text>file<message_text>) '{file_path}'<message_text>[({error_code})-({error_metadata_description})] FILE_UNCATEGORIZED

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

file_path is mapped to target.file.full_path

metadata_description is mapped to metadata.description

error_code is mapped to security_result.summary

error_metadata_description is mapped to security_result.summary

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

var/ossec/logs/ossec.log 2022/03/23 13:00:51 ossec-remoted(1206): ERROR: Unable to Bind port '1514' {timestamp} {application}(({pid}))<optional_field>{severity}:{metadata_description}port'{port}' STATUS_UPDATE

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

metadata_description is mapped to metadata.description

port is mapped to target.port

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

var/ossec/logs/ossec.log 2022/05/11 19:32:05 ossec-analysisd: INFO: Reading rules file: 'ms-se_rules.xml' {timestamp} {application}(({pid}))<optional_field>{severity}:{metadata_description}:'{file_path}' FILE_READ

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

metadata_description is mapped to metadata.description

file_path is mapped to target.file.full_path

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

var/ossec/logs/ossec.log 2022/05/11 19:32:06 ossec-analysisd: INFO: Ignoring file: '/etc/mnttab' {timestamp} {application}(({pid}))<optional_field>{severity}:<message_text>(ignoring|Ignoring file)<message_text>:'{file_path}' FILE_UNCATEGORIZED

application is mapped to target.application

pid is mapped to target.process.pid

severity is mapped to security_result.severity

file_path is mapped to target.file.full_path

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

ntpd process udp6 0 0 fe80::c59:3eff:fe14:123 :::* 999 20209 570/ntpd {protocol}{rec}{send}{ip}:{port}<message_text>{pid}/{process_name} STATUS_UPDATE

protocol is mapped to network.ip_protocol

pid is mapped to principal.process.pid

metadata.description is set to Program name: %{process_name}

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

syscheck File '/usr/bin/fwts' modified File '{file_path}' {description} FILE_MODIFICATION

description is mapped to metadata.description

file_path is mapped to target.file.full_path

metadata.vendor_name is set to "OSSEC"

metadata.product_name is set to "OSSEC"

principal.platform is set to "LINUX"

Audit

Audit log fields to UDM fields

The following table lists the log fields of the audit log type and their corresponding UDM fields.

Log field UDM field
acct target.user.user_display_name
addr principal.ip
arch about.labels.key/value
auid target.user.userid
cgroup principal.process.file.full_path
cmd target.process.command_line
comm target.application
cwd target.file.full_path
data about.labels.key/value
devmajor about.labels.key/value
devminor about.labels.key/value
egid target.group.product_object_id
euid target.user.userid
exe target.process.file.full_path
exit target.labels.key/value
family network.ip_protocol is set to "IP6IN4" if "ip_protocol" == 2 else it is set to "UNKNOWN_IP_PROTOCOL"
filetype target.file.mime_type
fsgid target.group.product_object_id
fsuid target.user.userid
gid target.group.product_object_id
hostname target.hostname
icmptype network.ip_protocol is set to "ICMP"
id If [audit_log_type] == "ADD_USER", target.user.userid is set to "%{id}"

If [audit_log_type] == "ADD_GROUP", target.group.product_object_id is set to "%{id}"

else target.user.attribute.labels.key/value is set to id

inode target.resource.product_object_id
key security_result.detection_fields.key/value
list security_result.about.labels.key/value
mode target.resource.attribute.permissions.name

target.resource.attribute.permissions.type

name target.file.full_path
new-disk target.resource.name
new-mem target.resource.attribute.labels.key/value
new-vcpu target.resource.attribute.labels.key/value
new-net pincipal.mac
new_gid target.group.product_object_id
oauid target.user.userid
ocomm target.process.command_line
opid target.process.pid
oses network.session_id
ouid target.user.userid
obj_gid target.group.product_object_id
obj_role target.user.attribute.role.name
obj_uid target.user.userid
obj_user target.user.user_display_name
ogid target.group.product_object_id
ouid target.user.userid
path target.file.full_path
perm target.asset.attribute.permissions.name
pid target.process.pid
ppid target.parent_process.pid
proto If [ip_protocol] == 2, network.ip_protocol is set to "IP6IN4"

else network.ip_protocol is set to "UNKNOWN_IP_PROTOCOL"

res security_result.summary
result security_result.summary
saddr security_result.detection_fields.key/value
sauid target.user.attribute.labels.key/value
ses network.session_id
sgid target.group.product_object_id
sig security_result.detection_fields.key/value
subj_user target.user.user_display_name
success If success=='yes', securtiy_result.summary is set to 'system call was successful'

else securtiy_result.summary is set to 'systemcall was failed'

suid target.user.userid
syscall about.labels.key/value
terminal target.labels.key/value
tty target.labels.key/value
uid If [audit_log_type] in [SYSCALL, SERVICE_START, ADD_GROUP, ADD_USER, MAC_IPSEC_EVENT, MAC_UNLBL_STCADD, OBJ_PID, CONFIG_CHANGE, SECCOMP, USER_CHAUTHTOK, USYS_CONFIG, DEL_GROUP, DEL_USER, USER_CMD, USER_MAC_POLICY_LOAD] uid is set to principal.user.userid

else uid is set to target.user.userid

vm target.resource.name

Audit log types to UDM event type

The following table lists the audit log types and their corresponding UDM event types.

Audit log type UDM event type Description
ADD_GROUP GROUP_CREATION Triggered when a user-space group is added.
ADD_USER USER_CREATION Triggered when a user-space user account is added.
ANOM_ABEND GENERIC_EVENT / PROCESS_TERMINATION Triggered when a processes ends abnormally (with a signal that could cause a core dump, if enabled).
AVC GENERIC_EVENT Triggered to record an SELinux permission check.
CONFIG_CHANGE USER_RESOURCE_UPDATE_CONTENT Triggered when the Audit system configuration is modified.
CRED_ACQ USER_LOGIN Triggered when a user acquires user-space credentials.
CRED_DISP USER_LOGOUT Triggered when a user disposes of user-space credentials.
CRED_REFR USER_LOGIN Triggered when a user refreshes their user-space credentials.
CRYPTO_KEY_USER USER_RESOURCE_ACCESS Triggered to record the cryptographic key identifier used for cryptographic purposes.
CRYPTO_SESSION PROCESS_TERMINATION Triggered to record parameters set during a TLS session establishment.
CWD SYSTEM_AUDIT_LOG_UNCATEGORIZED Triggered to record the current working directory.
DAEMON_ABORT PROCESS_TERMINATION Triggered when a daemon is stopped due to an error.
DAEMON_END PROCESS_TERMINATION Triggered when a daemon is successfully stopped.
DAEMON_RESUME PROCESS_UNCATEGORIZED Triggered when the auditd daemon resumes logging.
DAEMON_ROTATE PROCESS_UNCATEGORIZED Triggered when the auditd daemon rotates the Audit log files.
DAEMON_START PROCESS_LAUNCH Triggered when the auditd daemon is started.
DEL_GROUP GROUP_DELETION Triggered when a user-space group is deleted
Pending USER_DELETION Triggered when a user-space user is deleted
EXECVE PROCESS_LAUNCH Triggered to record arguments of the execve(2) system call.
MAC_CONFIG_CHANGE GENERIC_EVENT Triggered when an SELinux Boolean value is changed.
MAC_IPSEC_EVENT SYSTEM_AUDIT_LOG_UNCATEGORIZED Triggered to record information about an IPSec event, when one is detected, or when the IPSec configuration changes.
MAC_POLICY_LOAD GENERIC_EVENT Triggered when a SELinux policy file is loaded.
MAC_STATUS GENERIC_EVENT Triggered when the SELinux mode (enforcing, permissive, off) is changed.
MAC_UNLBL_STCADD SYSTEM_AUDIT_LOG_UNCATEGORIZED Triggered when a static label is added when using the packet labeling capabilities of the kernel provided by NetLabel.
NETFILTER_CFG GENERIC_EVENT Triggered when Netfilter chain modifications are detected.
OBJ_PID SYSTEM_AUDIT_LOG_UNCATEGORIZED Triggered to record information about a process to which a signal is sent.
PATH FILE_OPEN/GENERIC_EVENT Triggered to record file name path information.
SELINUX_ERR GENERIC_EVENT Triggered when an internal SELinux error is detected.
SERVICE_START SERVICE_START Triggered when a service is started.
SERVICE_STOP SERVICE_STOP Triggered when a service is stopped.
SYSCALL GENERIC_EVENT Triggered to record a system call to the kernel.
SYSTEM_BOOT STATUS_STARTUP Triggered when the system is booted up.
SYSTEM_RUNLEVEL STATUS_UPDATE Triggered when the system's run level is changed.
SYSTEM_SHUTDOWN STATUS_SHUTDOWN Triggered when the system is shut down.
USER_ACCT SETTING_MODIFICATION Triggered when a user-space user account is modified.
USER_AUTH USER_LOGIN Triggered when a user-space authentication attempt is detected.
USER_AVC USER_UNCATEGORIZED Triggered when a user-space AVC message is generated.
USER_CHAUTHTOK USER_RESOURCE_UPDATE_CONTENT Triggered when a user account attribute is modified.
USER_CMD USER_COMMUNICATION Triggered when a user-space shell command is executed.
USER_END USER_LOGOUT Triggered when a user-space session is terminated.
USER_ERR USER_UNCATEGORIZED Triggered when a user account state error is detected.
USER_LOGIN USER_LOGIN Triggered when a user logs in.
USER_LOGOUT USER_LOGOUT Triggered when a user logs out.
USER_MAC_POLICY_LOAD RESOURCE_READ Triggered when a user-space daemon loads an SELinux policy.
USER_MGMT USER_UNCATEGORIZED Triggered to record user-space management data.
USER_ROLE_CHANGE USER_CHANGE_PERMISSIONS Triggered when a user's SELinux role is changed.
USER_START USER_LOGIN Triggered when a user-space session is started.
USYS_CONFIG USER_RESOURCE_UPDATE_CONTENT Triggered when a user-space system configuration change is detected.
VIRT_CONTROL STATUS_UPDATE Triggered when a virtual machine is started, paused, or stopped.
VIRT_MACHINE_ID USER_RESOURCE_ACCESS Triggered to record the binding of a label to a virtual machine.
VIRT_RESOURCE USER_RESOURCE_ACCESS Triggered to record resource assignment of a virtual machine.

Mail

Mail log fields to UDM fields

The following table lists the log fields of the mail log type and their corresponding UDM fields.

Log field UDM field
Class about.labels.key/value
Ctladdr principal.user.user_display_name
From network.email.from
Msgid network.email.mail_id
Proto network.application_protocol
Relay intermediary.hostname

intermediary.ip

Size network.received_bytes
Stat security_result.summary
to network.email.to

Mail log types to UDM event type

The following table lists the mail log types and their corresponding UDM event types.

Mail log type UDM event type
sendmail GENERIC_EVENT
pickup EMAIL_UNCATEGORIZED
cleanup GENERIC_EVENT
qmgr EMAIL_UNCATEGORIZED
smtp GENERIC_EVENT
local EMAIL_UNCATEGORIZED

What's next