# Copyright (c) 2010 Flowerfire, Inc. All Rights Reserved. interscan_proxy_mmddyyyy = { plugin_version = "1.0.1" # Initial creation - 1.0 # 2011-01-03 - 1.0.1 - MSG - Edited info lines. info.1.manufacturer = "TrendMicro" info.1.device = "Interscan Proxy (mm/dd/yyyy)" info.1.version.1 = "" # The name of the log format log.format.format_label = "Interscan Proxy Log Format (mm/dd/yyyy dates)" log.miscellaneous.log_data_type = "firewall" log.miscellaneous.log_format_type = "network_device" # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = "^[0-9][0-9]/[0-9][0-9]/[0-9][0-9][0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9] .*: connection from [0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+, \"[A-Z]* [^ ]* [^ ]*/[0-9.]+\"" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" statistics.miscellaneous.entry_name = "accesses" # The format of dates and times in this log log.format.date_format = "mm/dd/yyyy" log.format.time_format = "hh:mm:ss" # Log fields log.fields = { date = { label = "$lang_stats.field_labels.date" type = "date" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # date time = { label = "$lang_stats.field_labels.time" type = "time" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # time action = { label = "$lang_stats.field_labels.action" type = "flat" index = 0 subindex = 0 } # action source_ip = { label = "$lang_stats.field_labels.source_ip" type = "host" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # source_ip source_hostname = { label = "$lang_stats.field_labels.source_hostname" type = "host" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # source_hostname operation = { label = "$lang_stats.field_labels.operation" type = "flat" index = 0 subindex = 0 } # operation page = { label = "$lang_stats.field_labels.page" type = "page" index = 0 subindex = 0 hierarchy_dividers = "/?" left_to_right = true leading_divider = "true" } # page protocol = { label = "$lang_stats.field_labels.protocol" type = "flat" index = 0 subindex = 0 } # protocol } # log.fields # # Log Parsing Filters log.parsing_filters = { # Parse a connection from line 1 = { label = "1" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+) .*http\\\\[([0-9]+)\\\\]: (connection) from ([0-9.]+), \"([A-Z]+) ([^ ]+) ([A-Z]+/[0-9.]+)\"', 'date,time,*KEY*,action,source_ip,operation,page,protocol')" } # 1 # Parse a connection from line 2 = { label = "2" comment = "" value = "collect_fields_using_regexp('^([0-9/]+) ([0-9:]+) .*http\\\\[([0-9]+)\\\\]: (connection) from ([^ ]+) \\\\(([0-9.]+)\\\\), \"([A-Z]+) ([^ ]+) ([A-Z]+/[0-9.]+)\"', 'date,time,*KEY*,action,source_ip,source_hostname,operation,page,protocol')" } # 2 # Parse a virus line 3 = { label = "3" comment = "" value = "collect_fields_using_regexp(' http\\\\[([0-9]+)\\\\]: Virus was found and deleted .* (Found virus .*) in file', '*KEY*,action')" } # 3 # Accept all lines 4 = { label = "4" comment = "" value = "accept_collected_entry_using_regexp('http\\\\[([0-9]+)\\\\]:', true)" } # 4 } # log.parsing_filters # Database fields database.fields = { date_time = { label = "$lang_stats.field_labels.date_time" log_field = "date_time" type = "string" suppress_top = 0 suppress_bottom = 3 display_format_type = "date_time" } # date_time day_of_week = { label = "$lang_stats.field_labels.day_of_week" log_field = "day_of_week" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "day_of_week" } # day_of_week hour_of_day = { label = "$lang_stats.field_labels.hour_of_day" log_field = "hour_of_day" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "hour_of_day" } # hour_of_day action = { label = "$lang_stats.field_labels.action" log_field = "action" type = "string" suppress_top = 0 suppress_bottom = 2 } # action source_ip = { label = "$lang_stats.field_labels.source_ip" log_field = "source_ip" type = "string" suppress_top = 0 suppress_bottom = 2 } # source_ip source_hostname = { label = "$lang_stats.field_labels.source_hostname" log_field = "source_hostname" type = "string" suppress_top = 0 suppress_bottom = 2 } # source_hostname page = { label = "$lang_stats.field_labels.page" log_field = "page" type = "string" suppress_top = 1 suppress_bottom = 3 display_format_type = "page" } # page file_type = { label = "$lang_stats.field_labels.file_type" log_field = "file_type" type = "string" suppress_top = 0 suppress_bottom = 2 } # file_type worm = { label = "$lang_stats.field_labels.worm" log_field = "worm" type = "string" suppress_top = 0 suppress_bottom = 2 } # worm operation = { label = "$lang_stats.field_labels.operation" log_field = "operation" type = "string" suppress_top = 0 suppress_bottom = 2 } # operation protocol = { label = "$lang_stats.field_labels.protocol" log_field = "protocol" type = "string" suppress_top = 0 suppress_bottom = 2 } # protocol } # database.fields # Log Filters log.filters = { remove_query = { label = "$lang_admin.log_filters.remove_query_label" comment = "$lang_admin.log_filters.remove_query_comment" value = "if (contains(page, '?')) then page = substr(page, 0, index(page, '?') + 1) . '(parameters)';" } # remove_query detect_page_views = { label = '$lang_admin.log_filters.detect_page_views_label' comment = '$lang_admin.log_filters.detect_page_views_comment' value = "if ((file_type eq 'JPEG') or (file_type eq 'JPG') or (file_type eq 'GIF') or (file_type eq 'ICO') or (file_type eq 'PNG') or (file_type eq 'CSS') or (file_type eq 'SWF') or (file_type eq 'JS')) then page_views = 0; else page_views = 1;" } # detect_page_views simplify_url = { label = "$lang_admin.log_filters.simplify_url_label" comment = "$lang_admin.log_filters.simplify_url_comment" value = "if (matches_regular_expression(page, '^([^:]+://[^/]+/)')) then page = $1 . '(omitted)'" } # simplify_url strip_non_page_views = { label = '$lang_admin.log_filters.strip_non_page_views_label' comment = '$lang_admin.log_filters.strip_non_page_views_comment' value = "if (page_views == 0) then page = substr(page, 0, last_index(page, '/') + 1) . '(nonpage)';" } # strip_non_page_views mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'accesses = 1;' } # mark_entry } # log.filters log.field_options = { sessions_page_field = "page" sessions_visitor_id_field = "source_ip" sessions_event_field = "page_views" } # log.field_options database.numerical_fields = { accesses = { label = "$lang_stats.field_labels.accesses" default = false requires_log_field = false type = "int" display_format_type = "integer" entries_field = true } # accesses page_views = { label = "$lang_stats.field_labels.page_views" default = true requires_log_field = false type = "int" display_format_type = "integer" } # page_views visitors = { label = "$lang_stats.field_labels.visitors" default = false requires_log_field = true log_field = "source_ip" type = "unique" display_format_type = "integer" } # visitors } # database.numerical_fields create_profile_wizard_options = { date_time_tracking = true host_tracking = true # How the reports should be grouped in the report menu report_groups = { date_time_group = "" action = true source_ip = true source_hostname = true page = true file_type = true worm = true operation = true protocol = true } # report_groups } # create_profile_wizard_options not_supported = { sessions = true bandwidth = true } # not_supported } # interscan_proxy_mmddyyyy