# Copyright (c) 2010 Flowerfire, Inc. All Rights Reserved. mcafee_secure_messaging_gateway = { plugin_version = "1.1" info.1.manufacturer = "McAfee" info.1.device = "Secure Messaging Gateway (SMG) VPN Firewall" info.1.version.1 = "3400" # 2008-01-22 - 1.0 - GMF - Created initial plug-in # 2011-03-08 - 1.1 - MSG - Added missing labels to the log filters # 2011-06-22 - 1.0.1 - MSG - Edited info lines. # The name of the log format log.format.format_label = "McAfee Secure Messaging Gateway (SMG) VPN Firewall" log.miscellaneous.log_data_type = "syslog_required" log.miscellaneous.log_format_type = "firewall" # e.g. # 2008-01-17 11:45:37 Mail.Info somerelay1.somewhere.org : Application=smtp, Event='RBL Lookup Triggered', status='Reject, close the connection', source=(12.34.56.78), msgid=302a_a8328262_c513_01da_8f17_0019b9e01ae2, convid=302a_a8328262_c513_01da_8f17_0019b9e01ae2 # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = ": Application=smtp, Event=" log.format.autodetect_lines = "2" # Log fields log.fields = { application = "" event = "" status = "" source = "" source_ip.type = "host" source_hostname = "" msgid = "" convid = "" } # log.fields # Log Parsing Filters log.parsing_filters.parse = ` if (matches_regular_expression(v.syslog_message, '^: (Application=.*)$')) then ( collect_listed_fields('', $1, ', ', '=', ''); # Strip quotes off event and status if (matches_regular_expression(get_collected_field('', 'event'), "^'(.*)'$")) then set_collected_field('', 'event', $1); if (matches_regular_expression(get_collected_field('', 'status'), "^'(.*)'$")) then set_collected_field('', 'status', $1); # Strip parentheses off source if (matches_regular_expression(get_collected_field('', 'source'), '^([^)]*)[(]([^]]+)[)]$')) then ( set_collected_field('', 'source_hostname', $1); set_collected_field('', 'source_ip', $2); ); set_collected_field('', 'events', 1); accept_collected_entry('', false); ) ` log.filters = { 0 = { comment = "" disabled = "false" label = "Message ID" value = "msgid = \"omitted\"" } # 0 1 = { comment = "" disabled = "false" label = "Conversation ID" value = "convid = \"omitted\"" } # 1 } # filters # Database fields database.fields = { date_time = "" hour_of_day = "" day_of_week = "" application = "" event = "" status = "" source_ip = "" source_hostname = "" # domain_description = "" location = "" organization = "" isp = "" domain = "" msgid = "" convid = "" } # database.fields database.numerical_fields = { events = { default = true requires_log_field = false entries_field = true } # events unique_source_ips = { log_field = "source_ip" type = "unique" } # unique_source_ips } # database.numerical_fields create_profile_wizard_options = { date_time_tracking = true # How the reports should be grouped in the report menu report_groups = { date_time_group = "" source_group = { source_ip = true source_hostname = true # domain_description = true location = true organization = true isp = true domain = true } application = "" event = "" status = "" msgid = "" convid = "" } # report_groups } # create_profile_wizard_options } # mcafee_secure_messaging_gateway