# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
watchguard_xml = {

  plugin_version = "1.4.1"

  info.1.manfacturer = "Watchguard"
  info.1.device = "Firebox XML"
  info.1.version = "750e"

  # 1.0Beta - new plugin
  # 1.1Beta - added FWStatus amd WGLog to the auto-detect regex
  # 2007-02-09 - 1.2Beta - gas - changed name of format to watchguard_xml.cfg
  #                            - added support for src_user field
  #                            - added support for lines that start with spaces
  #                            - added support for ProxyHTTPReq in the auto detect regex
  #                            - added support for FWConfig|ProxyConnBegin|ProxyConnEnd in the auto
  #                              detect regex
  # 2007-03-07 - 1.2.1beta - KBB - fixed bug in filter add_dstname_arg and changed it to not
  #                                concatenate dstname and arg if either is empty
  #                              - mapped field names rcvd_bytes and sent_bytes to recv and sent
  #                                since at least one format variation has these instead
  # 2007-09-14 - 1.2.1 - KBB - renumbered per new beta policy
  # 2008-07-28 - 1.3.0 - gas - changed regex to exclude trailing / for tag closure, caused crash on
  #                            WinXPx64
  #                          - added support for new fields (alarm_id, alarm_name, content_type, dst_intf,
  #                            dst_ip_nat, dst_port_nat, header, hostname, log_type, msg_id, pri,
  #                            proxy_act, rc, repeat, rule_name, src_ip_nat, src_port_nat)
  #                          - added some grouping to the report menu
  # 2008-09-11 - 1.4.0 - KBB - continued grouping process so all fields are in groups
  #                          - changed url to type page, added file_type field and remove_query filter
  #                          - added support for new fields: cats, new_msg (problematic - wraps other
  #                            fields - may want to parse value), op, pkt_len (mapped to
  #                            pckt_len which already existed) - field tcpinfo ignore for now
  # 2010-10-05 - 1.4.1 - MSG - Edited info lines.

  # The name of the log format
  log.format.format_label = "Watchguard XML Log Format"
  log.miscellaneous.log_data_type = "firewall"
  log.miscellaneous.log_format_type = "firewall"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = `^ *<(ProxyHT*PReq|ProxyMatch|FWAllow|FWDeny|FWStatus|WGLog|FWConfig|ProxyConnBegin|ProxyConnEnd) d="[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]" `

  # All log field parsing will be done using the parsing filters
  log.format.parse_only_with_filters = "true"

  # Log fields
  log.fields = {

    d.label = "watchguard date/time"
    date = ""
    time = ""
    event_type = ""
    orig = ""
    sn = ""
    tz = ""
    policy = ""
    src_ip.type = "host"
    dst_ip = ""
    pr = ""
    src_port = ""
    dst_port = ""
    type = ""
    dir = ""
    wgt = ""
    tcp_flags = ""
    proc_id = ""
    disp = ""
    src_intf = ""
    src_intf = ""
    dir = ""
    wgt = ""
    pckt_len = ""
    ttl = ""
    ip_hdr_len = ""

    version = ""
    encoding = ""
    msg = ""
    recv = ""
    sent = ""
    source = ""
    url.type = "page"
    why = ""
    dstname = ""
    src_user = ""

    alarm_id = ""
    alarm_name = ""
    content_type = ""
    dst_intf = ""
    dst_ip_nat = ""
    dst_port_nat = ""
    header = ""
    hostname = ""
    log_type = ""
    msg_id = ""
    pri = ""
    proxy_act = ""
    rc = ""
    repeat = ""
    rule_name = ""
    src_ip_nat = ""
    src_port_nat = ""

    cats = ""
    new_msg = ""
    op = ""
    tcpinfo = ""

  } # log.fields

  # Log Parsing Filters
  log.parsing_filters.parse = `

# e.g.: <ProxyHTTPReq d="2005-09-15T16:36:46" orig="192.168.1.1" policy="HTTP" src_ip="192.168.1.26" dst_ip="192.239.90.87" pr="TCP/http" src_port="2993" dst_port="80" type="HTTP" dir="out" wgt="2018" sent="326" recv="314"/>

if (matches_regular_expression(current_log_line(), '^<([^ ]*) (.*[^ /]) */?>$')) then (
  set_collected_field('', 'event_type', $1);
  collect_listed_fields('', $2, ' ', '=', 'arg=url|rcvd_bytes=recv|sent_bytes=sent|pkt_len=pckt_len');
  if (matches_regular_expression(get_collected_field('', 'd'), '^([0-9-]*)T([0-9:]*)$')) then (
    set_collected_field('', 'date', $1);
    set_collected_field('', 'time', $2);
  );
  set_collected_field('', 'events', 1);
  accept_collected_entry('', false);
);
`

  log.filters = {

    add_dstname_arg = {
      label = ""
      comment = ""
      value = `
if (dstname ne '(empty)') then (
  if (url eq '(empty)') then (
    url = dstname;
  );
  else (
    url = dstname . url;
  );
);
`
      position = "0"
    } # add_dstname_arg

    remove_query = {
      label = "$lang_admin.log_filters.remove_query_label"
      comment = "$lang_admin.log_filters.remove_query_comment"
      value = "if (contains(url, '?')) then url = substr(url, 0, index(url, '?') + 1) . '(parameters)';"
    } # remove_query

  } # log.filters

  # Database fields
  database.fields = {

    date_time = ""
    hour_of_day = ""
    day_of_week = ""
    event_type = ""
    orig = ""
    sn = ""
    tz = ""
    policy = ""

    src_user = ""
    src_ip = ""
    src_port = ""
    src_intf = ""
    src_ip_nat = ""
    src_port_nat = ""

    dst_ip = ""
    dst_port = ""
    dst_intf = ""
    dst_ip_nat = ""
    dst_port_nat = ""

    location = ""
    pr = ""
    type = ""
    dir = ""
    wgt = ""
    tcp_flags = ""
    proc_id = ""
    disp = ""
    dir = ""
    wgt = ""
    ttl = ""
    version = ""
    encoding = ""
    msg = ""
    source = ""
    url = ""
    file_type = ""
    why = ""

    alarm_id = ""
    alarm_name = ""
    content_type = ""
    header = ""
    hostname = ""
    log_type = ""
    msg_id = ""
    pri = ""
    proxy_act = ""
    rc = ""
    repeat = ""
    rule_name = ""

    cats = ""
    new_msg = ""
    op = ""
    #tcpinfo = ""

  } # database.fields

  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

    recv = {
      type = "float"
      display_format_type = "bandwidth"
    }

    sent = {
      type = "float"
      display_format_type = "bandwidth"
    }

    unique_source_ips = {
      log_field = "src_ip"
      type = "unique"
    } # unique_source_ips

    pckt_len = {
      type = "float"
      display_format_type = "bandwidth"
    }

    ip_hdr_len = {
      type = "float"
      display_format_type = "bandwidth"
    }

  } # database.numerical_fields

  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = {
        year_month_day = ""
        day = ""
        day_of_week = ""
        hour_of_day = ""
        tz = true
      }

      content_group = {
        url = true
        file_type = true
        encoding = true
        content_type = true
        cats = true
      }

      source_group = {
        orig = true
        hostname = true
        location = true
        src_user = true
        src_ip = true
        src_port = true
        src_intf = true
        src_ip_nat = true
        src_port_nat = true
      }

      destination_group = {
        dst_ip = true
        dst_port = true
        dst_intf = true
        dst_ip_nat = true
        dst_port_nat = true
      }

      other_group = {
        sn = true
        policy = true
        event_type = true
        pr = true
        disp = true
        pri = true
        rule_name = true
        alarm_id = true
        alarm_name = true
        msg = true
        msg_id = true
        header = true
        type = true
        dir = true
        wgt = true
        tcp_flags = true
        proc_id = true
        wgt = true
        ttl = true
        log_type = true
        proxy_act = true
        rc = true
        repeat = true
        version = true
        source = true
        why = true
        new_msg = true
        op = true
        #tcpinfo = true
      }

    } # report_groups

  } # create_profile_wizard_options

} # watchguard_xml