 |
 |
 |
Tutorial 5: Windows event logging Wed, 19 Dec 2007 The windows event log
As an introduction to windows event logging I recommend reading the following article: Monitoring and Troubleshooting Using Event Logs. It's the first interesting one I've found after googling for an introduction. This article reviews best practices for working with Windows event logs including how to interpret event messages, how to configure event logs, how to search and filter events, how to view events on remote systems, and how to use EventCombMT.exe and other tools to monitor events on multiple systems. ::start here Resuming, windows hosts by default log events into three local log "facilities": Architecture
For this tutorial we'll assume OSSIM being installed using the installer on 192.168.1.56. Log forwardersOSSECInstaller 1.0.4 will include ossec and I'll extend this tutorial once it's released since ossec offers many advantages over Snare. But for now we'll continue to using snare for a bit. Snare
You should start receiving events from now on. More on how to check this on the next section. AgentLess monitoring
Being at a recent commercial presentation by a commercial SIM, they repeated a couple of times how "agentless" they were, stating that they did collect windows events without needing to install anything.
Another interesting options seems to be the Microsoft Powershell. Its syntax is ugly as hell but it might do the job: Sample POSH event retrieval . OSSIM
Once they've been read and normalized by the agent Windows events are treated like all other events. They get:
Realtime Events
The first thing you can do in order to verify everything's up and running is checking the realtime event viewer. Please keep in mind that events might be arriving but not showing, look at the "skipped" column:
Events
The installer image comes with a plugin group for snare and a windows event tab pre-configured: What to do next?
Mass distributionSnare can be easily distributed on a wide range of host in a semi-automatic way. Check the documentation section at the Snare homepage. Troubleshooting
Dec 19 03:20:06 192.168.1.34 ^A MSWinEventLog;1;Application;2;Wed Dec 19 12:43:05 2007;105;SNARE; Unknown User;N/A;Information;NIL-MESA;None;;The service was started. ;1 Dec 19 03:21:01 192.168.1.34 ^A MSWinEventLog;0;Security;3;Wed Dec 19 12:44:00 2007;592;Security; Pruebas Antivirus;User;Success Audit;NIL-MESA;Detailed Tracking;;A new process has been created: ^I New Process ID:^I1724 ^IImage File Name:^I\WINNT\system32\cmd.exe ^ICreator Process ID:^I2744 ^I User Name:^IPruebas Antivirus ^IDomain:^I^INIL-MESA ^ILogon ID:^I^I(0x0,0x108EA) ;0 References
Conclusion
Windows log integration isn't perfect by default. The regular expression matching the above lines isn't perfect for every language/event type, so some event's might just end up in the "generic" category.
It is left as an exercise to the reader to combine the information shown here with that of Tutorial 2: Syslog data mining.
posted at: 15:54 | path: /ossim/tutorials | permanent link to this entry | 12 comments |
* Posted by Trevor at Fri Jan 4 01:42:15 2008
Out of the box, the snare plugin doesn't seem to be parsing any alerts from syslog where the username contains a space character (ex: "Unknown User"). Can you share with us the regexp used in your example?
* Posted by Dominique Karg at Mon Jan 7 13:01:06 2008
Sure, I just uploaded it to the cvs, this would match the spaces in some of the log fields:
[snare-ossim-format-fallthrough] #Feb 20 14:16:57 10.186.64.58 ^A MSWinEventLog;1;Security;466;Tue Feb 20 14:17:17 2007;538;Security;Administrador;User;Success Audit;QUICKSILVER-0JM08ZRD;Inicio/cierre de sesióCierre de sesióe usuario: ^INombrr e de usuario:^IAdministrador ^IDominio:^I^IQUICKSILVER-0JM08ZRD ^IId. de inicio de sesióI^I(0x0,0x200 E0FA) ^ITipo de inicio de sesióI7 ;61 event_type=event regexp="^(?P<date>\w+\s+\d{1,2}\s\d\d:\d\d:\d\d)\s+(?P<sensor>\S+)\s+.<b>MSWinEventLog;\d+;\w+;\d+;(?P<date2>\w+\s+\w+\s+\d{1,2}\s\d\d:\d\d:\d\d\s+\d+);(?P<plugin_sid>\d+);[^;]+;(?P<username>[^;]+);[^;]+;[^;]+;[^;]+;[^;]+;;(?P<userdata1>.</b>)" date={normalize_date($date)} sensor={resolv($sensor)} src_ip={resolv($sensor)} dst_ip={resolv($sensor)} plugin_id=1518 plugin_sid={$plugin_sid} username={$username} userdata1={$userdata1}
* Posted by Andres at Fri Jan 11 19:04:23 2008
Hello.
the documentation is good. but i have a doub how do i? to see another windows events, because when a follow your guide a saw the messages that you put in the page, but a can't see any more. In my /var/log/syslog a can saw other messages but in the web interface a can saw. Thanks for your help and colaboration
* Posted by Brian Lavender at Thu Apr 10 18:44:34 2008
I tried converting the snare_takeover.reg file with unix2dos. Then I double clicked the file and it gives the following error.
The specified file is not a registry script. You can only import binary registry files within the registry editor. I got the registry file from my http://ossim-server/ossim/downloads/snare_takeover.reg I suppose I could just modify these entries by hand, but double click seems so much easier.
* Posted by Brian Lavender at Sat Apr 12 00:20:16 2008
Hmm, can't seem to get the snare agent to snag the syslog data. I don't think the regex is catching my log entry. Here is a sample of a log entry.
Apr 11 17:14:23 2003_server 2003_server MSWinEventLog;0;Security;16;Fri Apr 11 17:14:19 2008;593;Security;lavendbr;User;Success Audit;2003_SERVER;Detailed Tracking;;A process has exited: ^IProcess ID:^I2012 ^IImage File Name:^IC:\WINDOWS\system32\cmd.exe ^IUser Name:^Ilavender ^IDomain:^I^I2003_SERVER ^ILogon ID:^I^I(0x0,0xBDEE9D) ;5
* Posted by Brian Lavender at Fri Apr 18 23:11:47 2008
It turns out that dns was the problem. The ossim server could not resolve the name of the Windows server.
* Posted by Brian Lavender at Fri May 9 17:21:40 2008
Dominique,
I see that OSSEC is part of the AV installer and it's running, but I don't see how it is integrated into OSSIM. I am looking at the details for it. Can you comment on it? brian
* Posted by shiju at Tue Dec 23 04:48:59 2008
Hi,
thanks for the tutorial , could you please provide the correlation examples also :) , like out of hour logins , service starts/stops,user adds/removals/etc... Thanks
|
Categories
/ (37) 
Archives
2008-Dec Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |
 |
