# Copyright (c) 2014 Flowerfire, Inc. All Rights Reserved. snort_multiline = { plugin_version = "1.0" # 2014-03-05 - 1.0 - GMF - Initial creation info.1.manufacturer = "IPCop" info.1.device = "IDS Snort (multiline)" info.1.version.1 = "" # The name of the log format log.format.format_label = "IPCop IDS Snort (multiline) Log Format" log.miscellaneous.log_data_type = "network" log.miscellaneous.log_format_type = "network_device" # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = "^IPCop IDS snort log" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" # The format of dates and times in this log log.format.date_format = "mm/dd" log.format.time_format = "hh:mm:ss" # Log fields log.fields = { date = "" time = "" name = "" priority = "" type = "" source_ip = "" source_port = "" destination_ip = "" destination_port = "" sid = "" refs = "" events = "" } # log.fields # Log Parsing Filters log.parsing_filters.parse = ` #Date: 03/04 12:22:34 #Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY #Priority: n/a #Type: n/a #IP Info: 156.34.136.30:54943 -> 74.217.148.111:80 #SID: n/a #Refs: # if (matches_regular_expression(current_log_line(), "^Date: ([0-9]+/[0-9]+) ([0-9:]+)")) then ( set_collected_field('', 'date', $1); set_collected_field('', 'time', $2); ); else if (matches_regular_expression(current_log_line(), "^IP Info: ([0-9.a-f:]+):([0-9]+) -> ([0-9.a-f:]+):([0-9]+)")) then ( set_collected_field('', 'source_ip', $1); set_collected_field('', 'source_port', $2); set_collected_field('', 'destination_ip', $3); set_collected_field('', 'destination_port', $4); ); else if (matches_regular_expression(current_log_line(), "^([^:]+): (.*)$")) then ( set_collected_field('', lowercase($1), $2); ); # Accept on final blank line else if (current_log_line() eq '') then accept_collected_entry('', false); ` # Database fields database.fields = { date_time = "" day_of_week = "" hour_of_day = "" name = "" priority = "" type = "" source_ip = "" source_port = "" destination_ip = "" destination_port = "" sid = "" refs = "" } # database.fields database.numerical_fields = { events = { default = true entries_field = true } # events } # database.numerical_fields log.filters = { mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'events = 1;' } # mark_entry } # log.filters create_profile_wizard_options = { # How the reports should be grouped in the report menu report_groups = { date_time_group = "" } # report_groups } # create_profile_wizard_options } # snort_multiline