From c12cdbe8f026596432642e89a385abeeab938325 Mon Sep 17 00:00:00 2001 From: eliasgrana <43425223+eliasgrana@users.noreply.github.com> Date: Tue, 7 Apr 2020 17:12:14 +0200 Subject: [PATCH 1/7] Create 0495-wazuh-api_decoders.xml --- decoders/0495-wazuh-api_decoders.xml | 68 ++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 decoders/0495-wazuh-api_decoders.xml diff --git a/decoders/0495-wazuh-api_decoders.xml b/decoders/0495-wazuh-api_decoders.xml new file mode 100644 index 000000000..d10c0ad4a --- /dev/null +++ b/decoders/0495-wazuh-api_decoders.xml @@ -0,0 +1,68 @@ + + + + WazuhAPI + + + + + + wazuhapi + \d+-\d+-\d+ \d+:\d+:\d+ \S+: [\S+] \w+ \S+ - \d+ + (\d+-\d+-\d+ \d+:\d+:\d+) (\S+): [(\S+)] (\w+) (\S+) - \d+ - error: '(\d+)' + timestamp,apiuser,remoteaddress,method,request,errorcode + + + + + + wazuhapi + + (\d+-\d+-\d+ \d+:\d+:\d+) (\S+): (\.+): \d+ + timestamp,apiuser,exception_message + + + + + + wazuhapi + Listening on + (\d+-\d+-\d+ \d+:\d+:\d+) : Listening on: (\.+) + timestamp,apiurl + + + + + + + wazuhapi + Authentication failed + (\d+-\d+-\d+ \d+:\d+:\d+) (\S+):\.+ Authentication failed + timestamp,apiuser + + + + + + + + wazuhapi + Address in use + (\d+-\d+-\d+ \d+:\d+:\d+) Error: Address in use \(port "(\d+)"\) + timestamp,port + + + + + + wazuhapi + Authentication error + (\d+-\d+-\d+ \d+:\d+:\d+) : [\.+] Authentication error: (\d+) - (\.+) + timestamp,auth_error,error_message + From 10ebccae8268b44a8038f5501133ca81835177a3 Mon Sep 17 00:00:00 2001 From: eliasgrana <43425223+eliasgrana@users.noreply.github.com> Date: Tue, 7 Apr 2020 17:14:00 +0200 Subject: [PATCH 2/7] Create 0685-wazuh-api_rules.xml --- rules/0685-wazuh-api_rules.xml | 165 +++++++++++++++++++++++++++++++++ 1 file changed, 165 insertions(+) create mode 100644 rules/0685-wazuh-api_rules.xml diff --git a/rules/0685-wazuh-api_rules.xml b/rules/0685-wazuh-api_rules.xml new file mode 100644 index 000000000..6c9d8a089 --- /dev/null +++ b/rules/0685-wazuh-api_rules.xml @@ -0,0 +1,165 @@ + + + + + + wazuhapi + + + + + + 30000 + ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: [(\S+)] \w+ \S+ - \d+ + Wazuh API request received. + + + + + + 30001 + GET + Wazuh API GET request received. + + + + 30002 + Wazuh API request $(method) $(request) with error code $(errorcode) + + + + 30003 + 0 + Wazuh API request $(method) $(request) + + + + 30001 + POST + Wazuh API request POST received. + + + + 30005 + Wazuh API request $(method) $(request) with error code $(errorcode) + + + + 30005 + 0 + Wazuh API request $(method) $(request) + + + + 30001 + DELETE + Wazuh API request DELETE received. + + + + 30008 + Wazuh API request $(method) $(request) got the error $(errorcode) + + + + 30008 + 0 + Wazuh API request $(method) $(request) + + + + 30001 + PUT + Wazuh API request PUT received. + + + + 30011 + Wazuh API request $(method) $(request) got the error $(errorcode) + + + + 30011 + 0 + Wazuh API request $(method) $(request) + + + + + + + 30000 + ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: \.+: \d+ + An exception was given, the message is: $(exception_message) + + + + + + 30000 + Authentication failed + Authentication with api from user $(apiuser) failed. + + + + + 30000 + Authentication error + Authentication with api failed with the error $(auth_error) and the message: $(error_message). + + + + + 30000 + Internal Error + Internal error detected in the API. + + + + + 30017 + Internal Error: uncaughtException + Internal error detected in the API, an uncaught exception was thrown. + + + + + 30000 + Exiting... + The API has just exited. + + + + + + 30019 + Exiting... (SIGTERM) + The API has just exited. (SIGTERM) + + + + 30019 + Exiting... (SIGINT) + The API has just exited. (SIGINT) + + + + 30000 + Listening on + Api is hearing at $(apiurl) + + + + + 30000 + Address in use + Another instance is using the port $(port) + + + From e252b7dcab8d88a3f938453fa70f7009ca35aecd Mon Sep 17 00:00:00 2001 From: eliasgrana <43425223+eliasgrana@users.noreply.github.com> Date: Tue, 7 Apr 2020 17:14:47 +0200 Subject: [PATCH 3/7] Update copyright --- decoders/0495-wazuh-api_decoders.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/decoders/0495-wazuh-api_decoders.xml b/decoders/0495-wazuh-api_decoders.xml index d10c0ad4a..593299fee 100644 --- a/decoders/0495-wazuh-api_decoders.xml +++ b/decoders/0495-wazuh-api_decoders.xml @@ -2,7 +2,7 @@ - WazuhAPI decoders - Author: Daniel Moreno - Updated by Wazuh, Inc. - - Copyright (C) 2015-2019, Wazuh Inc. + - Copyright (C) 2015-2020, Wazuh Inc. - This program is a free software; you can redistribute it and/or modify it under the terms of GPLv2. --> From 0d858020ab8e74126e6446d19acb1c4d9ab0072e Mon Sep 17 00:00:00 2001 From: eliasgrana <43425223+eliasgrana@users.noreply.github.com> Date: Tue, 7 Apr 2020 17:16:06 +0200 Subject: [PATCH 4/7] Create api.ini --- tools/rules-testing/tests/api.ini | 53 +++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 tools/rules-testing/tests/api.ini diff --git a/tools/rules-testing/tests/api.ini b/tools/rules-testing/tests/api.ini new file mode 100644 index 000000000..cd4f9817f --- /dev/null +++ b/tools/rules-testing/tests/api.ini @@ -0,0 +1,53 @@ +[Request to the api with errorcode 0] +log 1 pass = WazuhAPI 2019-02-27 15:23:17 user: [::ffff:11.0.0.19] GET /version? - 200 - error: '0'. +rule = 30004 +alert = 3 +decoder = wazuhapi + +[Generic exception message when the API is set in error mode] +log 1 pass = WazuhAPI 2019-03-19 13:46:48 foo: Agent does not exist: 500 -->