I've been experimenting with dynamic fields in decoders. In particular, I'm interested in adding more fields from web-access-logs, so I've done some local changes in the file "0375-web-accesslog_decoders_local.xml", as follows:
As you can see, I've added some stuff to the regex, so that I will get a "useragent"-field extracted, which I would then like to use in rules to match against, for example:
However, when trying to create the rule displayed above, ossec-logtest trows an error:
2020/09/15 09:19:31 ossec-testrule: ERROR: Invalid option 'useragent' for rule '32011'.
2020/09/15 09:19:31 ossec-testrule: CRITICAL: (1220): Error loading the rules: 'etc/rules/web_rules.xml'.
My question is simply; is it possible to add fields like this and use them in the rules in the way I want to here, or is it simply not possible? In that case, does that mean that the only option is to match against the build-in field-names? I've been reading in the documentation (linked below), but there is only a mention of dynamic fields in decoders, but not really in rules. The "field"-option in the rules syntax section seems to suggest that this should work though. Thanks in advance!
I've been experimenting with dynamic fields in decoders. In particular, I'm interested in adding more fields from web-access-logs, so I've done some local changes in the file "0375-web-accesslog_decoders_local.xml", as follows:
As you can see, I've added some stuff to the regex, so that I will get a "useragent"-field extracted, which I would then like to use in rules to match against, for example:
The decoder works, as displayed below:
However, when trying to create the rule displayed above, ossec-logtest trows an error:
My question is simply; is it possible to add fields like this and use them in the rules in the way I want to here, or is it simply not possible? In that case, does that mean that the only option is to match against the build-in field-names? I've been reading in the documentation (linked below), but there is only a mention of dynamic fields in decoders, but not really in rules. The "field"-option in the rules syntax section seems to suggest that this should work though. Thanks in advance!