UNITY 360: Issueshttp://www.prelude-siem.org/http://www.prelude-siem.org/welcome/themes/prelude/favicon/Prelude-icon.png2022-06-16T08:36:22ZUNITY 360
Redmine PRELUDE SIEM - Bug #1253 (New): Support on K8s Prelude Siem versionhttp://www.prelude-siem.org/issues/12532022-06-16T08:36:22ZQuentin Maraval
<p>Hello,<br />i am currently working on the "chartization" of Prelude in order to get it running inside Kubernetes cluster.<br />I used this repository <a class="external" href="https://github.com/fpoirotte/docker-prelude-siem">https://github.com/fpoirotte/docker-prelude-siem</a> that does the same work for docker with OSS version of prelude.</p>
<p>I updated the docker image, changed the Os container from Centos to Opensuse leap.<br />I have the project running (not tested the correlator yet), however it still on OSS version and i would like to get it running in SIEM version.</p>
<p>So to achieve this i will need some support from you on this task.</p>
<p>I have a couple questions :<br />- Where can i download the packages for SIEM version for Opensuse ? <br />- How can we proceed for key generation/licence knowing that the helm chart deployment can occurs many times as we are on cloud (delete/reinstall for testing purpose etc..)</p>
<p>Thanks,<br />Quentin</p> PRELUDE SIEM - Bug #1211 (New): prelude-admin does not work on Debian after fresh installhttp://www.prelude-siem.org/issues/12112020-06-23T15:32:18ZSebastian K
<p>I am trying to use prelude-admin on a Ubuntu-like system. In particular, I want to register to a server. Unfortunately, this is not possible.</p>
<p>When installing prelude 5.1.0 via sources, it does build successfully, but I get a single failed test during 'make check':</p>
<pre><code class="text syntaxhl"><span class="CodeRay">...
PASS: test-localename
../../test-driver: line 95: 6213 Aborted "$@" > $log_file 2>&1
FAIL: test-rwlock1
PASS: test-lock
...
</span></code></pre>
<p>The command 'prelude-admin' does show the help menu, but adding any argument or command, e.g. 'prelude-admin register' results in a SegFault (similar to another issue: <a class="external" href="https://www.prelude-siem.org/issues/1092">https://www.prelude-siem.org/issues/1092</a>). The log file states "Unexpected outcome 3".</p>
<p>Then I tried installing the binaries (v4.1.0) after removing everything with 'make uninstall' and rebooting the system. Following the docs, I installed it via <br /><pre><code class="text syntaxhl"><span class="CodeRay">apt install prelude-utils
</span></code></pre><br /> Now, I can execute the registration command like this without an SegFault:<br /><pre><code class="text syntaxhl"><span class="CodeRay">prelude-admin register my_sensor_name "idmef:w" <x.x.x.x> --uid 0 --gid 0
</span></code></pre><br />This throws an error stating that<br /><pre><code class="text syntaxhl"><span class="CodeRay">error creating directory /var/spool/prelude/my_sensor_name: No such file or directory.
</span></code></pre></p>
<p>I am root on this system, so it shouldn't be a kind of access issue. Also, the server works just fine.</p>
<p>Can somebody tell me, where these errors come from and how I can fix them?</p>
<p>Thanks in advance,<br />Sebastian</p> Prewikka - Support #1153 (Assigned): Suricata changes the output from version 4http://www.prelude-siem.org/issues/11532019-11-07T18:40:10ZAndrew Goldy
<p>Hello Guys!</p>
<p>Suricata might has changed? the default prelude-alert output, because comparing to the old release 3.x the alert text was the alert name for example "ET POLICY Self Signed SSL Certificate (SomeOrganizationalUnit)", and now the alert text is swapped to description for example "Potential Corporate Privacy Violation".<br />Moreover comparing to snort its confirmed something was wrong with the alerting output at least in case of prelude in suricata.</p>
<p>Below the real world examples with the same alert from snort and suricata aspects. Both outputs are natively forwarded to prelude. <br />I've contacted suricata for months but still no answer... Is there any workaround to swap the two columns regarding suricata?</p>
<p><img src="http://www.prelude-siem.org/attachments/download/1184/tempsnip.png" alt="" /></p>
<p>Suricata:</p>
<p><img src="http://www.prelude-siem.org/attachments/download/1186/jzff.PNG" alt="" /></p>
<p>Snort:</p>
<p><img src="http://www.prelude-siem.org/attachments/download/1185/ftzfztfztd.PNG" alt="" /></p>
<p>Many thanks! <img src="/plugin_assets/redmine_wiki_extensions/images/smile.png" alt=":)"></p> PRELUDE SIEM - Bug #1134 (Assigned): prewikka install on raspbianhttp://www.prelude-siem.org/issues/11342019-08-01T09:21:33ZMarc-Antoine delannoy
<p>Hello, <br />I'm trying to set up the latest version of prelude OSS on raspbian. With some effort I installed almost everything. <br />However, I have a problem with prewikka whose installation doesn't work. I have installed all the dependencies.<br />But I'm getting some errors when I run this command -> python setup.py install</p>
<pre><code class="text syntaxhl"><span class="CodeRay">root@raspberrypi:/home/prelude/prewikka-5.0.2# python setup.py install
running install
running build
running compile_catalog
error: prewikka/locale/de/LC_MESSAGES/prewikka.po:1560: placeholders are incompatible
compiling catalog prewikka/locale/de/LC_MESSAGES/prewikka.po to prewikka/locale/de/LC_MESSAGES/prewikka.mo
error: prewikka/locale/ru/LC_MESSAGES/prewikka.po:47: unknown named placeholder u'value'
error: prewikka/locale/ru/LC_MESSAGES/prewikka.po:162: unknown named placeholder u'version'
error: prewikka/locale/ru/LC_MESSAGES/prewikka.po:1593: placeholders are incompatible
compiling catalog prewikka/locale/ru/LC_MESSAGES/prewikka.po to prewikka/locale/ru/LC_MESSAGES/prewikka.mo
error: prewikka/locale/pl/LC_MESSAGES/prewikka.po:1587: placeholders are incompatible
error: prewikka/locale/pl/LC_MESSAGES/prewikka.po:1870: placeholders are incompatible
compiling catalog prewikka/locale/pl/LC_MESSAGES/prewikka.po to prewikka/locale/pl/LC_MESSAGES/prewikka.mo
error: prewikka/locale/es/LC_MESSAGES/prewikka.po:1554: placeholders are incompatible
error: prewikka/locale/es/LC_MESSAGES/prewikka.po:2126: placeholders are incompatible
error: prewikka/locale/es/LC_MESSAGES/prewikka.po:2226: placeholders are incompatible
error: prewikka/locale/es/LC_MESSAGES/prewikka.po:2231: placeholders are incompatible
compiling catalog prewikka/locale/es/LC_MESSAGES/prewikka.po to prewikka/locale/es/LC_MESSAGES/prewikka.mo
error: prewikka/locale/pt_BR/LC_MESSAGES/prewikka.po:1546: placeholders are incompatible
error: prewikka/locale/pt_BR/LC_MESSAGES/prewikka.po:2119: placeholders are incompatible
compiling catalog prewikka/locale/pt_BR/LC_MESSAGES/prewikka.po to prewikka/locale/pt_BR/LC_MESSAGES/prewikka.mo
compiling catalog prewikka/locale/fr/LC_MESSAGES/prewikka.po to prewikka/locale/fr/LC_MESSAGES/prewikka.mo
error: prewikka/locale/it/LC_MESSAGES/prewikka.po:43: unknown named placeholder u'value'
error: prewikka/locale/it/LC_MESSAGES/prewikka.po:1550: placeholders are incompatible
compiling catalog prewikka/locale/it/LC_MESSAGES/prewikka.po to prewikka/locale/it/LC_MESSAGES/prewikka.mo
compiling catalog prewikka/locale/en/LC_MESSAGES/prewikka.po to prewikka/locale/en/LC_MESSAGES/prewikka.mo
running build_custom
compiling ['themes/dark.less', 'prewikka/htdocs/css/style.less'] -> prewikka/htdocs/css/themes/dark.css
error: [Errno 2] No such file or directory
</span></code></pre>
<p>there is a problem with languages. The second problem I guess it is: prewikka/htdocs/css/themes/dark.css that is not found.<br />Package installation does not seem possible in version 5 for a debian-based distribution (4 is the last version i found).</p>
<p>Do you have any idea how to solve this?<br />Regards</p> Prewikka - Support #1031 (Assigned): Authentication errorhttp://www.prelude-siem.org/issues/10312019-01-06T17:29:51ZRobin IRLINGER
<p>Hi,</p>
<p>I've a trouble with Auth in Prewikka. It's impossible to enable [auth loginpassword] in /etc/prewikka/prewikka.conf: "Cannot use auth mode 'loginpassword', please contact your local administrator". (cf. print screen)</p>
<p>Do you have any suggestions ?</p>
<p>Thanks.</p>
<p>Robin</p> Prelude-LML - Bug #915 (New): Text spelling issuehttp://www.prelude-siem.org/issues/9152017-10-16T21:51:10ZThomas ANDREJAKthomas.andrejak@csgroup.eu
Two issues :
<ul>
<li>supressed => suppressed</li>
<li>authentification => authentication</li>
</ul> Prelude-LML-Rules - Feature #906 (New): CVE-2017-9798 - OptionsBleed - Detectionhttp://www.prelude-siem.org/issues/9062017-09-21T16:05:36ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>In order to detect OptionsBleed, you need this LML rules to be able to do the right correlation</p> Prelude-LML - Bug #872 (New): Prelude-LML check not workinghttp://www.prelude-siem.org/issues/8722017-01-28T18:26:52ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>Since we move rules to another subproject (prelude-lml-rules), make check is not working. Error in "tests" folder.</p> Prelude-LML - Feature #315 (New): Using Named variables in PCRE rulesethttp://www.prelude-siem.org/issues/3152008-09-13T20:42:09Z
<p>Named Variables in pcre:</p>
<p>This would make for quicker and simpler rules to be created in prelude-lml.</p>
<p>Example from ntsyslog.rules:</p>
<pre>
regex=security\[success\] 528 (.*) Successful Logon: User Name:(?<username>[\w ]+) Domain:(?<domain>.+) Logon ID:\(?<lid>.*\) Logon Type:(?<ltype>\d+) Logon Process:(?<lprocess>\w+) .* Workstation Name:(?<wks>\S+);
classification.text=Login; \
classification.reference(0).origin=vendor-specific; \
classification.reference(0).meaning=Windows Event ID; \
classification.reference(0).name=528; \
classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com189.html; \
id=1401; \
revision=3; \
analyzer(0).name=NTsyslog; \
analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
analyzer(0).class=Logging; \
assessment.impact.severity=low; \
assessment.impact.completion=succeeded; \
assessment.impact.type=user; \
assessment.impact.description=$username successfully logged on on $wks ($domain domain) via $ltype; \
source(0).process.name=$5; \
source(0).node.address(0).category=unknown; \
source(0).node.address(0).address=$wks; \
source(0).node.name=$wks; \
source(0).user.category=os-device; \
source(0).user.user_id(0).type=current-user; \
source(0).user.user_id(0).name=$username; \
target(0).user.user_id(0).type=current-user; \
target(0).user.user_id(0).name=$username; \
additional_data(0).type=integer; \
additional_data(0).meaning=Logon type; \
additional_data(0).data=$ltype; \
additional_data(1).type=string; \
additional_data(1).meaning=Authentication domain; \
additional_data(1).data=$domain; \
last
</pre> Prewikka - Feature #260 (New): IDMEF XML View in Prewikkahttp://www.prelude-siem.org/issues/2602007-09-08T18:04:30Z
<p>Hey there,</p>
<p>I would suggest the following feature for prewikka: In the detailed alert view</p>
<p>/?view=alert_summary&origin=alert_listing&messageid=$alert.messageid</p>
<p>there should be the possibility to view this event in pure IDMEF XML, too. This would make it easier to get an IDMEF overview and indepth view, as well as it makes it easier to create rules/filters on IDMEF criteria, i.e. if using the smtp plugin or just some other custom filters</p> Prewikka - Feature #240 (New): [PATCH] - SSL Client Certificate Authentification modulehttp://www.prelude-siem.org/issues/2402007-06-18T16:58:01Z
<p>Hi</p>
<p>Here is a patch to use a SSL Client certificate to authenticate user. The username should be equal to the user certificate CN (the full DN is too long to be used, login field is limited to 32 char)</p>
Limitations:
<ul>
<li>Currently only tested in a SSL mod_python setup</li>
<li>Need SSLOptions +StdEnvVars</li>
<li>Used with python 2.3</li>
</ul>
<p>In prewikka.conf</p>
<pre>
[auth ssl]
</pre>
<p>And this file in a new directory <em>prewikka/modules/auth/ssl/</em><br /><pre>
# Copyright (C) 2006 [[PreludeIDS]] Technologies. All Rights Reserved.
# Author: Francois Harvey <fharvey+prelude at securiweb dot net>
#
# This file is part of the Prewikka program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING. If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
import os
from prewikka import Auth, User, Database
# Use the SSL_CLIENT_S_DN_CN from a SSL x509 Certificate to map the user
class SSLAuth(Auth.Auth):
def getUser(self, request):
if not request._req.subprocess_env['HTTPS']:
raise Auth.AuthError(message=_("SSL Authentication failed: Not in a SSL session."))
user = request._req.subprocess_env['SSL_CLIENT_S_DN_CN']
if not user:
raise Auth.AuthError(message=_("SSL Authentication failed: no user specified (hint: look at the certificate CN)."))
return User.User(self.db, user, self.db.getLanguage(user), User.ALL_PERMISSIONS, self.db.getConfiguration(user))
def load(env, config):
return SSLAuth(env)
</pre></p> Prelude-LML - Feature #238 (New): manpagehttp://www.prelude-siem.org/issues/2382007-06-09T00:32:30Z
<p>Here is a manpage for prelude-lml, mostly taken from --help command line and the wiki. Please review for integration.</p> Prelude-LML - Bug #215 (New): ntsyslog.rules does not detect domain login eventshttp://www.prelude-siem.org/issues/2152007-04-03T17:44:11Z
<p>The ruleset appears to detect only host-based login attempts rather than login attempts against a domain.</p>
<p>event id 675: (bad password)</p>
<p>security[failure] 675 NT AUTHORITY\SYSTEM Pre-authentication failed: User Name:mike User ID: %{x-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxx} Service Name:krbtgt/HQ Pre-Authentication Type:0x2 Failure Code:0x18 Client<br />Address:10.120.120.152</p>
<p>more info: <a class="external" href="http://www.ultimatewindowssecurity.com/events/com298.html">http://www.ultimatewindowssecurity.com/events/com298.html</a></p> Prelude-LML - Bug #214 (New): Invalid classification reference in several LML rulesetshttp://www.prelude-siem.org/issues/2142007-04-03T17:37:44ZYoann VANDOORSELAERE
<p>Some LML rulesets are missing an "url" field for the Classification Reference. IDMEF specify that the "url" member of a Reference has to be specified.</p>
Example of such rulesets are:
<ul>
<li>cisco-vpn.rules</li>
<li>cisco-css.rules</li>
</ul> Prelude-LML - Bug #213 (New): LML rulesets should be updated to use IDMEF Actionhttp://www.prelude-siem.org/issues/2132007-04-03T17:31:44ZYoann VANDOORSELAERE
<p>Current rulesets (except modsecurity) does not make use of the IDMEF Action class.</p>
<pre>
4.2.6.2. The Action Class
The Action class is used to describe any actions taken by the
analyzer in response to the event.
category
The type of action taken. The permitted values are shown below.
The default value is "other". (See also Section 10.)
+------+-------------------+----------------------------------------+
| Rank | Keyword | Description |
+------+-------------------+----------------------------------------+
| 0 | block-installed | A block of some sort was installed to |
| | | prevent an attack from reaching its |
| | | destination. The block could be a |
| | | port block, address block, etc., or |
| | | disabling a user account. |
| | | |
| 1 | notification-sent | A notification message of some sort |
| | | was sent out-of-band (via pager, |
| | | e-mail, etc.). Does not include the |
| | | transmission of this alert. |
| | | |
| 2 | taken-offline | A system, computer, or user was taken |
| | | offline, as when the computer is shut |
| | | down or a user is logged off. |
| | | |
| 3 | other | Anything not in one of the above |
| | | categories. |
+------+-------------------+----------------------------------------+
The element itself may be empty, or may contain a textual
description of the action, if the analyzer is able to provide
additional details.
</pre>