Feeding DShield with OSSEC Logs

Published: 2015-09-11
Last Updated: 2015-09-14 09:42:42 UTC
by Xavier Mertens (Version: 2)
6 comment(s)

Today, I'd like to promote a tool that I wrote four years ago and that is running every 30 minutes on my OSSEC server. DShield offers many clients to collect and process logs from multiple firewall brands/vendors. But today, more and more logs are already centralized to a SIEM. Collecting the events twice can be a pain for performance, complexity and security reasons. I'm collecting firewall logs from many devices with OSSEC so there are stored in a central place. The idea of ossec2dshield is to read the logs from OSSEC and forward them to DShield. Writing a DShield agent is easy, everything is described here. Basically, the script parses the OSSEC's firewall.log and generates the corresponding DShield events. 

The script syntax is self-explanatory:

$ ossec2dshield.pl --log=file --userid=dshieldid --statefile=file --from=email --mta=hostname
                  [--help] [--debug] [--test] [--obfuscate] [--ports=port1,port2,...]  
Where: 
--help                   : This help
--debug                  : Display processing details to stdout
--test                   : Test only, do not mail the info to dshield.org
--obfuscate              : Obfuscate the destination address (10.x.x.x)
--ports=port1,!port2,... : Filter destination ports ex: !25,!80,445,53 
--log=file               : Your OSSEC firewall.log
--userid=dshieldid       : Your dshield.org UserID (see http://www.dshield.org)
--statefile=file         : File to write the state of log processing
--from=email             : Your e-mail address (From:)
--mta=hostname           : Your Mail Transfer Agent (to send mail to dshield.org)

You will need your dshield.org UserID, a mail relay (MTA). The state file is very important: it contains the timestamp of the last processed event. This prevents events to be sent twice to dshield.org. Once processed, the data will be submitted to register(at)dshield(dot)org. Using “–-port“, you can exclude or restrict to some interesting ports. Example: “–-port=’!80,!22,!443′” will report all blocked firewall traffic except for the destination ports 80, 22 and 443. The current version of the script is not so powerful as the regular Dshield clients but it works very well. Ideas and suggestions are always welcome. The script is available in my github.com repository. Happy logging!

Xavier Mertens
ISC Handler - Freelance Security Consultant
rootshell.be
truesec.be

Keywords:
6 comment(s)

Comments

Disclaimer: This may be off-topic, since it's not directly related to your tool. However, I wanted to better understand the roles/benefits of OSSEC? Is it a SIEM, IDS, HIDS, or all rolled into one? Where is its sweet spot? We're currently don't have a SIEM or dedicated (H)IDS, although we do have IPS as a blade on our Check Point UTM. Could we utilize OSSEC as a SIEM & IDS solution, as well as for file integrity, Windows registry monitoring & even IR?
OSSEC presents itself as a Host based IDS. But IMHO, it goes much deeper! The core features are:
- Centralization of log files
- Creation of security rules that triggers notifications or actions
- FIM
- Rootkit detection
- Active-Response (ex: temporary block an attacker's IP address)

About your question: Yes, Windows is supported (only agents - the servers MUST run on UNIX). Ping me off-list if you want to discuss about OSSEC!
@AAInfoSec, OSSEC is more a HIDS. You can check out OSSIM which is an open source SIEM from AlienVault that uses OSSEC. They also have a commercial offering USM.

@Xme, apologies for hijacking your thread.
@Mike7, no worries! The goal of this forum is to share useful information.
Not very relevant, but:

[--obfusctate]

seems to be misspelled. Might confuse someone who is using this tool, especially people who (like me) like to copy/paste in order to avoid typos...
Thanks for reporting the typo. I fixed it.

Diary Archives