inter_scan_viruswall = { # The name of the log format log.format.format_label = "InterScan Viruswall Log Format" log.miscellaneous.log_data_type = "generic" log.miscellaneous.log_format_type = "network_device" # The log is in this format if any of the first ten lines match this regular expression # This \\ was here, but why? GMF # log.format.autodetect_regular_expression = "^[0-9]+/[0-9]+\\/[0-9]+ [0-9]+:[0-9]+:[0-9]+ ISCAN-" log.format.autodetect_regular_expression = "^[0-9]+/[0-9]+/[0-9]+ [0-9]+:[0-9]+:[0-9]+ I[sS][cC][aA][nN]-" # The format of dates and times in this log log.format.date_format = "mm/dd/yyyy" log.format.time_format = "hh:mm:ss" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" # Log fields log.fields = { date = { label = "$lang_stats.field_labels.date" type = "date" } # date time = { label = "$lang_stats.field_labels.time" type = "time" } # time service = { label = "$lang_stats.field_labels.service" type = "flat" } # service source_ip = { label = "$lang_stats.field_labels.source_ip" type = "host" hierarchy_dividers = "." left_to_right = false leading_divider = "false" } # source_ip operation = { label = "$lang_stats.field_labels.operation" type = "flat" } # operation url = { label = "$lang_stats.field_labels.url" type = "page" hierarchy_dividers = "/?" left_to_right = true leading_divider = "true" } # url protocol = { label = "$lang_stats.field_labels.protocol" type = "flat" } # protocol from = { label = "$lang_stats.field_labels.from" type = "flat" } # from to = { label = "$lang_stats.field_labels.to" type = "flat" } # to } # log.fields # # Log Parsing Filters log.parsing_filters = { # Parse out date, time parse = { label = "parse" comment = "" value = " if (matches_regular_expression(current_log_line(), '^([0-9]+/[0-9]+/[0-9]+) ([0-9]+:[0-9]+:[0-9]+) I[Ss][Cc][Aa][Nn]-([a-z0-9]+)\\\\[[0-9]+\\\\]: (.*)$')) then ( set_collected_field('', 'date', $1); set_collected_field('', 'time', $2); set_collected_field('', 'service', $3); v.message = $4; if (matches_regular_expression(v.message, '^([0-9.]+)->([A-Z]*) (http://[^ ]+) ([A-Z]+/[0-9.]+)$')) then ( set_collected_field('', 'source_ip', $1); set_collected_field('', 'operation', $2); set_collected_field('', 'url', $3); set_collected_field('', 'protocol', $4); ) else if (matches_regular_expression(v.message, '^([0-9.]+) ([A-Z]*) (http://.*)$')) then ( set_collected_field('', 'source_ip', $1); set_collected_field('', 'operation', $2); set_collected_field('', 'url', $3); ) else if (matches_regular_expression(v.message, '^Message from: <([^>]*)>')) then set_collected_field('', 'from', $1); else if (matches_regular_expression(v.message, '^Message to: <([^>]*)>')) then set_collected_field('', 'to', $1); accept_collected_entry('', false); ); " } # parse } # log.parsing_filters # Database fields database.fields = { date_time = { label = "$lang_stats.field_labels.date_time" log_field = "date_time" type = "string" suppress_top = 0 suppress_bottom = 3 display_format_type = "date_time" } # date_time day_of_week = { label = "$lang_stats.field_labels.day_of_week" log_field = "day_of_week" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "day_of_week" } # day_of_week hour_of_day = { label = "$lang_stats.field_labels.hour_of_day" log_field = "hour_of_day" type = "string" suppress_top = 0 suppress_bottom = 2 display_format_type = "hour_of_day" } # hour_of_day source_ip = { label = "$lang_stats.field_labels.source_ip" log_field = "source_ip" type = "string" suppress_top = 0 suppress_bottom = 2 } # source_ip domain_description = { label = "$lang_stats.field_labels.domain_description" log_field = "domain_description" type = "string" suppress_top = 0 suppress_bottom = 2 } # domain_description location = { label = "$lang_stats.field_labels.location" log_field = "location" type = "string" suppress_top = 0 suppress_bottom = 3 } # location url = { label = "$lang_stats.field_labels.url" log_field = "url" type = "string" suppress_top = 0 suppress_bottom = 9 } # url worm = { label = "$lang_stats.field_labels.worm" log_field = "worm" type = "string" suppress_top = 0 suppress_bottom = 2 } # worm protocol = { label = "$lang_stats.field_labels.protocol" log_field = "protocol" type = "string" suppress_top = 0 suppress_bottom = 2 } # protocol operation = { label = "$lang_stats.field_labels.operation" log_field = "operation" type = "string" suppress_top = 0 suppress_bottom = 2 } # operation service = { label = "$lang_stats.field_labels.service" log_field = "service" type = "string" suppress_top = 0 suppress_bottom = 2 } # service from = { label = "$lang_stats.field_labels.from" log_field = "from" type = "string" suppress_top = 0 suppress_bottom = 2 } # from to = { label = "$lang_stats.field_labels.to" log_field = "to" type = "string" suppress_top = 0 suppress_bottom = 2 } # to } # database.fields # Log Filters log.filters = { mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'events = 1;' } # mark_entry } # log.filters database.numerical_fields = { events = { label = "$lang_stats.field_labels.events" default = true requires_log_field = false type = "int" display_format_type = "integer" entries_field = true } # events unique_source_ips = { label = "$lang_stats.field_labels.unique_source_ips" default = false requires_log_field = true log_field = "source_ip" type = "unique" display_format_type = "integer" } # unique_source_ips } # database.numerical_fields create_profile_wizard_options = { date_time_tracking = true host_tracking = true # How the reports should be grouped in the report menu report_groups = { date_time_group = "" content_group = { url = true worm = true } users_group = { source_ip = true domain_description = true location = true from = true to = true } other_group = { protocol = true operation = true service = true } } # report_groups } # create_profile_wizard_options not_supported = { pageviews = true sessions = true bandwidth = true } # not_supported } # inter_scan_viruswall