From c12cdbe8f026596432642e89a385abeeab938325 Mon Sep 17 00:00:00 2001
From: eliasgrana <43425223+eliasgrana@users.noreply.github.com>
Date: Tue, 7 Apr 2020 17:12:14 +0200
Subject: [PATCH 1/7] Create 0495-wazuh-api_decoders.xml
---
decoders/0495-wazuh-api_decoders.xml | 68 ++++++++++++++++++++++++++++
1 file changed, 68 insertions(+)
create mode 100644 decoders/0495-wazuh-api_decoders.xml
diff --git a/decoders/0495-wazuh-api_decoders.xml b/decoders/0495-wazuh-api_decoders.xml
new file mode 100644
index 000000000..d10c0ad4a
--- /dev/null
+++ b/decoders/0495-wazuh-api_decoders.xml
@@ -0,0 +1,68 @@
+
+
+
+ WazuhAPI
+
+
+
+
+
+ wazuhapi
+ \d+-\d+-\d+ \d+:\d+:\d+ \S+: [\S+] \w+ \S+ - \d+
+ (\d+-\d+-\d+ \d+:\d+:\d+) (\S+): [(\S+)] (\w+) (\S+) - \d+ - error: '(\d+)'
+ timestamp,apiuser,remoteaddress,method,request,errorcode
+
+
+
+
+
+ wazuhapi
+
+ (\d+-\d+-\d+ \d+:\d+:\d+) (\S+): (\.+): \d+
+ timestamp,apiuser,exception_message
+
+
+
+
+
+ wazuhapi
+ Listening on
+ (\d+-\d+-\d+ \d+:\d+:\d+) : Listening on: (\.+)
+ timestamp,apiurl
+
+
+
+
+
+
+ wazuhapi
+ Authentication failed
+ (\d+-\d+-\d+ \d+:\d+:\d+) (\S+):\.+ Authentication failed
+ timestamp,apiuser
+
+
+
+
+
+
+
+ wazuhapi
+ Address in use
+ (\d+-\d+-\d+ \d+:\d+:\d+) Error: Address in use \(port "(\d+)"\)
+ timestamp,port
+
+
+
+
+
+ wazuhapi
+ Authentication error
+ (\d+-\d+-\d+ \d+:\d+:\d+) : [\.+] Authentication error: (\d+) - (\.+)
+ timestamp,auth_error,error_message
+
From 10ebccae8268b44a8038f5501133ca81835177a3 Mon Sep 17 00:00:00 2001
From: eliasgrana <43425223+eliasgrana@users.noreply.github.com>
Date: Tue, 7 Apr 2020 17:14:00 +0200
Subject: [PATCH 2/7] Create 0685-wazuh-api_rules.xml
---
rules/0685-wazuh-api_rules.xml | 165 +++++++++++++++++++++++++++++++++
1 file changed, 165 insertions(+)
create mode 100644 rules/0685-wazuh-api_rules.xml
diff --git a/rules/0685-wazuh-api_rules.xml b/rules/0685-wazuh-api_rules.xml
new file mode 100644
index 000000000..6c9d8a089
--- /dev/null
+++ b/rules/0685-wazuh-api_rules.xml
@@ -0,0 +1,165 @@
+
+
+
+
+
+ wazuhapi
+
+
+
+
+
+ 30000
+ ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: [(\S+)] \w+ \S+ - \d+
+ Wazuh API request received.
+
+
+
+
+
+ 30001
+ GET
+ Wazuh API GET request received.
+
+
+
+ 30002
+ Wazuh API request $(method) $(request) with error code $(errorcode)
+
+
+
+ 30003
+ 0
+ Wazuh API request $(method) $(request)
+
+
+
+ 30001
+ POST
+ Wazuh API request POST received.
+
+
+
+ 30005
+ Wazuh API request $(method) $(request) with error code $(errorcode)
+
+
+
+ 30005
+ 0
+ Wazuh API request $(method) $(request)
+
+
+
+ 30001
+ DELETE
+ Wazuh API request DELETE received.
+
+
+
+ 30008
+ Wazuh API request $(method) $(request) got the error $(errorcode)
+
+
+
+ 30008
+ 0
+ Wazuh API request $(method) $(request)
+
+
+
+ 30001
+ PUT
+ Wazuh API request PUT received.
+
+
+
+ 30011
+ Wazuh API request $(method) $(request) got the error $(errorcode)
+
+
+
+ 30011
+ 0
+ Wazuh API request $(method) $(request)
+
+
+
+
+
+
+ 30000
+ ^WazuhAPI \d+-\d+-\d+ \d+:\d+:\d+ \S+: \.+: \d+
+ An exception was given, the message is: $(exception_message)
+
+
+
+
+
+ 30000
+ Authentication failed
+ Authentication with api from user $(apiuser) failed.
+
+
+
+
+ 30000
+ Authentication error
+ Authentication with api failed with the error $(auth_error) and the message: $(error_message).
+
+
+
+
+ 30000
+ Internal Error
+ Internal error detected in the API.
+
+
+
+
+ 30017
+ Internal Error: uncaughtException
+ Internal error detected in the API, an uncaught exception was thrown.
+
+
+
+
+ 30000
+ Exiting...
+ The API has just exited.
+
+
+
+
+
+ 30019
+ Exiting... (SIGTERM)
+ The API has just exited. (SIGTERM)
+
+
+
+ 30019
+ Exiting... (SIGINT)
+ The API has just exited. (SIGINT)
+
+
+
+ 30000
+ Listening on
+ Api is hearing at $(apiurl)
+
+
+
+
+ 30000
+ Address in use
+ Another instance is using the port $(port)
+
+
+
From e252b7dcab8d88a3f938453fa70f7009ca35aecd Mon Sep 17 00:00:00 2001
From: eliasgrana <43425223+eliasgrana@users.noreply.github.com>
Date: Tue, 7 Apr 2020 17:14:47 +0200
Subject: [PATCH 3/7] Update copyright
---
decoders/0495-wazuh-api_decoders.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/decoders/0495-wazuh-api_decoders.xml b/decoders/0495-wazuh-api_decoders.xml
index d10c0ad4a..593299fee 100644
--- a/decoders/0495-wazuh-api_decoders.xml
+++ b/decoders/0495-wazuh-api_decoders.xml
@@ -2,7 +2,7 @@
- WazuhAPI decoders
- Author: Daniel Moreno
- Updated by Wazuh, Inc.
- - Copyright (C) 2015-2019, Wazuh Inc.
+ - Copyright (C) 2015-2020, Wazuh Inc.
- This program is a free software; you can redistribute it and/or modify it under the terms of GPLv2.
-->
From 0d858020ab8e74126e6446d19acb1c4d9ab0072e Mon Sep 17 00:00:00 2001
From: eliasgrana <43425223+eliasgrana@users.noreply.github.com>
Date: Tue, 7 Apr 2020 17:16:06 +0200
Subject: [PATCH 4/7] Create api.ini
---
tools/rules-testing/tests/api.ini | 53 +++++++++++++++++++++++++++++++
1 file changed, 53 insertions(+)
create mode 100644 tools/rules-testing/tests/api.ini
diff --git a/tools/rules-testing/tests/api.ini b/tools/rules-testing/tests/api.ini
new file mode 100644
index 000000000..cd4f9817f
--- /dev/null
+++ b/tools/rules-testing/tests/api.ini
@@ -0,0 +1,53 @@
+[Request to the api with errorcode 0]
+log 1 pass = WazuhAPI 2019-02-27 15:23:17 user: [::ffff:11.0.0.19] GET /version? - 200 - error: '0'.
+rule = 30004
+alert = 3
+decoder = wazuhapi
+
+[Generic exception message when the API is set in error mode]
+log 1 pass = WazuhAPI 2019-03-19 13:46:48 foo: Agent does not exist: 500 -->