Rule file items

Configuration item Remarks

<var name="FREQ">8</var>
…
<group name="...">
<rule … frequency="$FREQ">
…

 Declares constants at the top of the file.
<group name="...">
<rule ...>
…
</rule>
</group>

<rule> items must be under a <group> item.

The name attribute is mandatory and ends with a comma.

Used in classifying rules found in the group.
<rule id="123456"> The id attribute of a rule is mandatory, with a value between 1 and 999999 inclusive.
<rule overwrite="yes|no"> Makes it possible to do away with a unique id attribute, replaces a rule that was defined earlier.
<rule level="0..15"> Mandatory. Assigns a level of severity to the rule; level 0 rules are evaluated on a higher priority than others.
<rule accuracy="0"> Gives rules containing this attribute lower priority than others.
<rule maxsize="0..9999"> Makes it possible for the rule to apply only to logs with a message that is at least as long as the value of this attribute.
<rule timeframe="..." frequency="..."> Declares a composite rule that is triggered if an event occurs several times within the defined time frame.
<rule noalert="..."> Considers that a rule does not apply if no child rules apply.
<rule ignore="..."> Inhibits the rule for a set number of seconds after it is triggered.
<rule id="..." level="...">
<decoded_as>...</decoded_as>
</rule>

Indicates the first-level decoder (or second-level using the use_own_name option) that must have been used for the message.

SES Evolution supports decoder names from all levels and ignores the use_own_name option.
<rule id="..." level="...">
<if_sid>...</if_sid>
</rule>		 Links a rule to a parent rule with a rule ID.
<rule id="..." level="...">
<if_group>...</if_group>
</rule>		 Links a rule to parent rules with a group name.
<rule id="..." level="...">
<if_level>...</if_level>
</rule>		 Links a rule to parent rules with a minimum level of severity.

<rule id="..." level="...">
<regex>...</regex>
</rule>

<rule id="..." level="...">
<match>...</match>
</rule>

<rule id="..." level="...">
<pcre2>...</pcre2>
</rule>

<rule id="..." level="...">
<match_pcre2>...</match_pcre2>
</rule>

Simple/advanced OSSEC/PCRE2/PCRE2 regular expression targeting the log message to determine whether the rule matches.

NOTE
The last two variants are synonymous.

<rule id="..." level="...">
<user>...</user>
</rule>

<rule id="..." level="...">
<user_pcre2>...</user_pcre2>
</rule>

 Simple OSSEC/PCRE2 regular expression targeting the srcuser decoded field, or if there isn’t one, the dstuser decoded field, to determine whether the rule matches.

<rule id="..." level="...">
<srcip>...</srcip>
</rule>

<rule id="..." level="...">
<dstip>...</dstip>
</rule>

IPv4 or IPv6 address specification (individual addresses, ranges, networks with mask length, etc.) compared to the srcip or dstip fields to determine whether the rule matches.

The specification can be expressed as a negative by placing an exclamation mark in front of it.

<rule id="..." level="...">
<srcport>...</srcport>
</rule>

<rule id="..." level="...">
<srcport_pcre2>...</srcport_pcre2>
</rule>

<rule id="..." level="...">
<dstport>...</dstport>
</rule>

<rule id="..." level="...">
<dstport_pcre2>...</dstport_pcre2>
</rule>

 Simple OSSEC/PCRE2 regular expressions targeting the srcport and dstport decoded fields to determine whether the rule matches.

<rule id="..." level="...">
<id>...</id>
</rule>

<rule id="..." level="...">
<id_pcre2>...</id_pcre2>
</rule>

 Simple OSSECPCRE2 regular expression targeting the id decoded field to determine whether the rule matches.

<rule id="..." level="...">
<status>...</status>
</rule>

<rule id="..." level="...">
<status_pcre2>...</status_pcre2>
</rule>

 Simple OSSEC/PCRE2 regular expression targeting the status decoded field to determine whether the rule matches.

<rule id="..." level="...">
<hostname>...</hostname>
</rule>

<rule id="..." level="...">
<hostname_pcre2>...</hostname_pcre2>
</rule>

 Simple OSSEC/PCRE2 regular expression targeting the hostname pre-decoded field to determine whether the rule matches.

<rule id="..." level="...">
<extra_data>...</extra_data>
</rule>

<rule id="..." level="...">
<extra_data_pcre2>...</extra_data_pcre2>
</rule>

 Simple OSSEC/PCRE2 regular expression targeting data decoded field to determine whether the rule matches.

<rule id="..." level="...">
<program_name>...</program_name>
</rule>

<rule id="..." level="...">
<program_name_pcre2>...</program_name_pcre2>
</rule>

 Simple OSSEC/PCRE2 regular expression targeting the program_name pre-decoded field to determine whether the rule matches.

<rule id="..." level="...">
<url>...</url>
</rule>

<rule id="..." level="...">
<url_pcre2>...</url_pcre2>
</rule>

 Simple OSSEC/PCRE2 regular expression targeting the url decoded field to determine whether the rule matches.
<rule id="..." level="...">
<action>...</action>
</rule>		 Exact value compared to the action decoded field to determine whether the rule matches.
<rule id="..." level="...">
<field name="...">...</field>
</rule>		 Advanced OSSEC regular expression targeting the decoded field indicated, to determine whether the rule matches.
<rule id="..." level="...">
<time>...</time>
</rule>

Specifies the time slot during which the rule applies. Supports any format that OSSEC supports.

EXAMPLE
<time>1:30-17:45</time> ; <time>1 am - 12:30 PM</time> ; <time>!08:00-17:30</time>

SES Evolution uses the system time zone to evaluate local time.
<rule id="..." level="...">
<weekday>...</weekday>
</rule>

Specifies the days of the week when the rule is enabled. Supports any format that OSSEC supports.

EXAMPLE
<weekday>wed fri sun</weekday> ; <weekday>weekdays sunday</weekday> ; <weekday>! tue wed</weekday>

SES Evolution uses the system time zone to evaluate local time, and therefore the day.

<rule id="..." level="...">
<cve>...</cve>
</rule>

<rule id="..." level="...">
<info type="cve">...</info>
</rule>

 Describes the rule by associating it with a known vulnerability.

<rule id="..." level="...">
<info type="text">...</info>
</rule>

<rule id="..." level="...">
<info type="link">...</info>
</rule>

<rule id="..." level="...">
<info type="osvdb">...</info>
</rule>

Describes the rule using text, a link or an Open Source Vulnerability Database item.

SES Evolution supports only a single item of each type in the same rule.
<rule id="..." level="...">
<group>...</group>
</rule>		 Adds groups that the rule belongs to, in addition to those specified in the rule's parent <group> node.
<rule id="..." level="...">
<description>...</description>
</rule>		 Mandatory description of the event to which the rule applies. SES Evolution uses this description in the log summary that appears in the agent and console.
<rule id="..." level="...">
<category>...</category>
</rule>		 Links the rule to one of the decoder types. Option used for rules 1 to 7 in the file rules_config.xml.
<rule id="..." level="...">
<if_fts/>
</rule>		 Makes the rule effective only if a decoder has detected (with the fts option) that a set of fields had values seen together for the first time.

<rule id="..." level="...">
<ignore>...</ignore>
</rule>

<rule id="..." level="...">
<check_if_ignored>...</check_if_ignored>
</rule>

 Makes it possible to cache sets of field values, and disable a rule later for the same value sets.
<rule id="..." level="...">
<check_diff/>
</rule>		 Allows you to ignore two consecutive and identical logs.
<rule id="..." level="..." frequency="..." timeframe="...">
<if_matched_regex>...</if_matched_regex>
</rule>		 Makes it possible to trigger a composite rule if several logs generated recently can be described with an advanced OSSEC regular expression.
<rule id="..." level="..." frequency="..." timeframe="...">
<if_matched_group>...</if_matched_group>
</rule>		 Makes it possible to trigger a composite rule if several logs generated recently were described with a rule in a given group
<rule id="..." level="..." frequency="..." timeframe="...">
<if_matched_sid>...</if_matched_sid>
</rule>		 Makes it possible to trigger a composite rule if several logs generated recently were described with a rule that has a given ID.

<rule id="..." level="..." frequency="..." timeframe="...">
<same_source_ip/>
</rule>

<rule id="..." level="..." frequency="..." timeframe="...">
<same_src_port/>
</rule>

<rule id="..." level="..." frequency="..." timeframe="...">
<same_dst_port/>
</rule>

<rule id="..." level="..." frequency="..." timeframe="...">
<same_id/>
</rule>

<rule id="..." level="..." frequency="..." timeframe="...">
<same_user/>
</rule>

Makes it possible to trigger a composite rule if several logs sharing the same srcip, srcport, dstport, id or user field are found.

<rule id="..." level="..." frequency="..." timeframe="...">
<different_srcip/>
</rule>

<rule id="..." level="..." frequency="..." timeframe="...">
<different_url/>
</rule>

 Makes it possible to trigger a composite rule if several logs with separate vales are found for the same srcip or url field.
Configuration item Supported Remarks

<rule id="..." level="...">
<srcgeoip>...</srcgeoip>
</rule>

<rule id="..." level="...">
<srcgeoip_pcre2>...</srcgeoip_pcre2>
</rule>

<rule id="..." level="...">
<dstgeoip>...</dstgeoip>
</rule>

<rule id="..." level="...">
<dstgeoip_pcre2>...</dstgeoip_pcre2>
</rule>

 No SES Evolution does not use the libgeoip library.
<rule id="..." level="...">
<list lookup="..." field="...">...</list>
</rule>		 No

Quick search for a field in a CDB (container database).

SES Evolution does not use the CDB library.
<rule id="..." level="...">
<compiled_rule>...</compiled_rule>
</rule>		 Partial

Allows users to compile their own rules for specific needs.

SES Evolution supports the is_simple_http_request function, which serves as an example, but is used in standard rule sets.
<rule id="..." level="...">
<options>...</options>
</rule>		 Partial SES Evolution supports only the no_log option; e-mail alerts or active responses are not supported.

<rule id="..." level="..." frequency="..." timeframe="...">
<not_same_source_ip/>
</rule>

<rule id="..." level="..." frequency="..." timeframe="...">
<not_same_id/>
</rule>

<rule id="..." level="..." frequency="..." timeframe="...">
<not_same_user/>
</rule>

No Unnecessary OSSEC options in a configuration with the sole purpose of canceling a <same_...> option written earlier in the same rule: you are advised to remove the previous option.

<rule id="..." level="..." frequency="..." timeframe="...">
<same_location/>
</rule>

<rule id="..." level="..." frequency="..." timeframe="...">
<not_same_agent/>
</rule>

No SES Evolution analyzes and correlates logs at the agent level instead of the server level. As a result, multiple agent logs cannot be correlated; these options will therefore be ignored.
<rule id="..." level="..." frequency="..." timeframe="...">
<different_srcgeoip/>
</rule>		 No SES Evolution does not use the libgeoip library.