Event Rules

This section is used to configure active response operations used by the Log Correlation Engine daemon. Log Correlation Engine rules are configured to analyze Log Correlation Engine event content and fire if preset conditions are met. Active responses include the ability to send automatic emails (msmtp, sendmail), syslog alerts (syslog, cef), or run custom commands on the Log Correlation Engine system.

Creating Event Rules

To add a new event rule to your configuration, in the Advanced section of Configuration, under Event Rules, click the Add a New Rule button. The Create an event rule window appears. Using this window, you can specify a name, filters, and an action to be taken.

The following table outlines the syntax that can be applied to filters and actions. Some examples are also available.

Rule Filters

In the Filter drop-down box, select a filter that you want to use for the event rule. The values in the Type box are contextual, based on the filter you select. In some cases, you may not need to specify a type. Generally, you will need to specify whether you want to filter data that includes or excludes the values you specify. You can specify multiple filters.

Filters Description

Source IP (SrcIPS)

This filter will search for source IP addresses that are or are not present. The following five formats are supported:

  • 192.0.2.1/255.255.255.0
  • 192.0.2.1/32
  • 192.0.2.1-255
  • 192.0.2.1-192.0.2.255
  • 192.0.2.1

Each of these formats represent a single value. You can include a comma-delimited list of values using one or a mix of these formats.

Example:

192.0.2.1/32, 192.0.2.1-255, 192.0.2..10

Destination IP (DstIPS)

This filter will search for destination IP addresses that are or are not present. The following five formats are supported:

  • 192.0.2.1/255.255.255.0
  • 192.0.2.1/32
  • 192.0.2.1-255
  • 192.0.2.1-192.0.2.255
  • 192.0.2.1

Each of these formats represent a single value. You can include a comma-delimited list of values using one or a mix of these formats.

Example: 192.0.2.1/32, 192.0.2.1-255, 192.0.2..10

IP (IPS)

This filter allows for the search of IP addresses that are or are not present as either source or destination. The following five formats are supported:

  • 192.0.2.1/255.255.255.0
  • 192.0.2.1/32
  • 192.0.2.1-255
  • 192.0.2.1-192.0.2.255
  • 192.0.2.1

Each of these formats represent a single value. You can include a comma-delimited list of values using one or a mix of these formats.

Example: 192.0.2.1/32, 192.0.2.1-255, 192.0.2..10

Events

Filter on Log Correlation Engine normalized event name. Considers both the primary and secondary event names.

Example: Cisco-IDS_Command_Execution, Windows-Successful_Network_Login, Linux-User_Added

Sensors

Filter on sensor name (available in the Tenable Log Correlation Engine sensor summary view or under Sensor Names) or Tenable Log Correlation Engine client name.

Example: XPmarketing01, Win7payroll02

Types

Filter on Log Correlation Engine event type.

Example: login, login-failure, intrusion

Ports

Filter on the source or destination port.

Example: 80, 443

Protocols

Filter on the protocol of the event. Note that this means the protocol number as defined by IPv4 (1 for ICMP, 6 for TCP, etc.)

Example: 1, 6

Users

Filter on the username in a log.

Example: bobt, johnc

Text

Filter on any string in the log (strings can include spaces and punctuation, but not commas).

Example: Tenable Network Security

Text, caseless (IText)

Filter on any string in the log, but the text considered would be case insensitive (strings can include spaces and punctuation, but not commas).

Example: Tenable Network Security

Vulnerable

Only accepts yes or no. Specify yes if you want to only match logs that correlate to vulnerable hosts.

Threshold

The number of events required over a specified length of time to trigger the rule. The timeframe is expressed using the following format:

(integer) in a [second, minute, hour, day, week, month, year]

Example: 600 in a minute

MaxQueue

The number of events that will be placed into the event processing queue before being dropped from rule evaluation.

Ratelimit

The maximum number of triggers that will occur over a specified length of time regardless of the number of triggering events. The timeframe is expressed using the following format:

(integer) per [second, minute, hour, day, week, month, year]

Example: 1 per hour

Rule Actions

In the Action drop-down box, specify an action that you want to take based on the filters you created. The following table describes the actions that are available.

Action Description

Shell command

Runs the given command at the command line as user lce. Examples of the syntax and variables you can use with the shell command follow this table.

Syslog Forward logs triggered by this rule to the given syslog server. Examples of the syslog syntax follow this table.
CEF Forward logs triggered by this rule to the given syslog server in CEF format. An example of the CEF syntax follows this table.
Ignore Causes all events matching the filters to be ignored by Log Correlation Engine. If an event is ignored in this manner there will be no Log Correlation Engine database entry written for it, no other matching event rules will fire, and no TASLs will process this event for alerts. You cannot enter a value for this action.

Email Syntax

Command: echo "body: $log" | sendmail [email protected] "subject: $event1 from $sip"

Command: echo "This is a test message." | /opt/lce/tools/msmtp -C /opt/lce/tools/msmtp.conf [email protected]

Syslog Syntax

The following syslog line would forward any log that triggered the rule to the remote syslog server 10.10.10.10, port 514, with the default priority of 36 (severity=4, facility=4):

syslog: 10.10.10.10 "Possible password guessing evidence: $log"

The following syslog line would forward any log that triggered the rule to two remote syslog servers, 10.10.10.9, and 10.10.10.10, on port 515, with the specified priority of 116 (severity=4, facility=14):

syslog: 10.10.10.9, 10.10.10.10 "Your message goes here: $log" -priority 116 -port 515

CEF Syntax

The following value would forward any log that triggered the rule to two remote syslog servers, 10.10.10.9, and 10.10.10.10, on port 515:

10.10.10.9, 10.10.10.10 -port 515

Custom Command Syntax

Command: /path/to/scripts/my_custom_firewall_reconfig_command.sh -block $sip

Shell Command Variables

The following case sensitive variables may be included in the shell command string. Any commands using one or more the of shell command variables below need to be encapsulated in double quotations ("").

Option Description

$sip

Source IP of event

$dip

Destination IP of event

$sport

Source port of event

$dport

Destination port of event

$proto

Protocol of event, displayed as N/A, TCP, UDP, ICMP, or a number for other protocols

$vuln

"no" if the event was not correlated with a vulnerability, "yes" otherwise.

$sensor

Name of sensor generating the event

$event1

Primary event name

$event2

Secondary event name

$type

Type name of event

$time

Time event was recorded at Log Correlation Engine (format: Mon MM, YYYY H:M:S)

$user

Username associated with the event

$log

Raw text of log

$queued_logs

All logs currently in the event rules queue. Use of this variable has the effect of emptying the rule's queue

Show All Event Rules

You can display all configured event rules ordered by descending time of creation or modification with psqlf show-config--mv--event_rules.sql.

Example output: