Today, Id like to promotea tool that I wrote four years ago and thatis running every 30 minutes on my OSSEC server. DShield offers manyclients to collect and process logs from multiple firewall brands/vendors. But today, more and more logs are already centralized to a SIEM. Collecting the events twice can be a pain for performance, complexity andsecurity reasons. Im collecting firewall logs from many devices with OSSECso there are stored in a central place. The idea of ossec2dshield is to read the logs from OSSEC and forward them to DShield. Writing a DShield agent is easy, everything is described here. Basically, the script parses the OSSECs firewall.log and generatesthe correspondingDShield events."> $ ossec2dshield.pl --log=file --userid=dshieldid --statefile=file --from=email --mta=hostname [--help] [--debug] [--test] [--obfusctate] [--ports=port1,port2,...] Where: --help : This help--debug : Display processing details to stdout--test : Test only, do not mail the info to dshield.org--obfuscate : Obfuscate the destination address (10.x.x.x)--ports=port1,!port2,... : Filter destination ports ex: !25,!80,445,53 --log=file : Your OSSEC firewall.log--userid=dshieldid : Your dshield.org UserID (see http://www.dshield.org)--statefile=file : File to write the state of log processing--from=email : Your e-mail address (From:)">You will need your dshield.org UserID, a mail relay (MTA). The state file is very important: it containsthe timestamp of the last processed event. This prevents events to be sent twice to dshield.org. Once processed, the data will be submitted to register(at)dshield(dot)org. Using ">-port, you can exclude or restrict to some interesting ports. Example: ">-port=!80,!22,!443 will report all blocked firewall traffic except for the destination ports 80, 22 and 443.The current version of thescript is not so powerful as the regular Dshield clients but it works very well. Ideas and suggestions are always welcome.The script is available in my" title="Link to the website">github.comrepository. Happy logging!
Xavier Mertens
ISC Handler - Freelance Security Consultant
rootshell.be
truesec.be