mirror of
https://github.com/rsyslog/rsyslog.git
synced 2025-12-11 05:00:41 +01:00
b3a124b0ae
Rename the Snare Windows Security parser module from "mmsnarewinsec" to "mmsnareparse" for clearer naming and consistency with other parser modules. Update code identifiers, build system, docs, tests, CI flags, and paths accordingly. What changed - MODULE_CNFNAME set to "mmsnareparse"; default macro renamed - Log/error/debug tags updated to "mmsnareparse" - plugins/mmsnarewinsec/* moved to plugins/mmsnareparse/* - configure.ac: - add --enable-mmsnareparse - AM_CONDITIONAL(ENABLE_MMSNAREPARSE) - AC_CONFIG_FILES now includes plugins/mmsnareparse/Makefile - Makefile.am subdir switch to plugins/mmsnareparse - Tests renamed and updated (scripts and testsuites directory) - Docs page renamed and examples updated - CI workflow uses --enable-mmsnareparse - Rebase to main; resolved configure.ac conflict Impact - Backwards-incompatible module name and configure flag changes. Migration - Config: module(load="mmsnareparse"), action(type="mmsnareparse") - Build: use --enable-mmsnareparse Co-authored-by: alorbach <alorbach@adiscon.com>
88 lines
1.9 KiB
Bash
Executable File
88 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
## Validate custom pattern loading and section detection for mmsnareparse.
|
|
unset RSYSLOG_DYNNAME
|
|
. ${srcdir:=.}/diag.sh init
|
|
|
|
DEF_FILE="${RSYSLOG_DYNNAME}.defs.json"
|
|
cat >"$DEF_FILE" <<'JSON'
|
|
{
|
|
"sections": [
|
|
{
|
|
"pattern": "Custom Block*",
|
|
"canonical": "CustomBlock",
|
|
"behavior": "standard",
|
|
"priority": 250,
|
|
"sensitivity": "case_insensitive"
|
|
}
|
|
],
|
|
"fields": [
|
|
{
|
|
"pattern": "CustomEventTag",
|
|
"canonical": "CustomEventTag",
|
|
"section": "EventData",
|
|
"priority": 80,
|
|
"value_type": "string"
|
|
}
|
|
],
|
|
"eventFields": [
|
|
{
|
|
"event_id": 4001,
|
|
"patterns": [
|
|
{
|
|
"pattern": "WidgetID",
|
|
"canonical": "WidgetID",
|
|
"section": "CustomBlock",
|
|
"value_type": "string"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"events": [
|
|
{
|
|
"event_id": 4001,
|
|
"category": "Custom",
|
|
"subtype": "Injected",
|
|
"outcome": "success"
|
|
}
|
|
]
|
|
}
|
|
JSON
|
|
|
|
generate_conf
|
|
add_conf '
|
|
module(load="../plugins/imtcp/.libs/imtcp")
|
|
module(load="../plugins/mmsnareparse/.libs/mmsnareparse" \
|
|
definition.file="'${PWD}/${DEF_FILE}'" \
|
|
validation.mode="strict")
|
|
|
|
template(name="customfmt" type="list") {
|
|
property(name="$!win!Event!Category")
|
|
constant(value=",")
|
|
property(name="$!win!CustomBlock!WidgetID")
|
|
constant(value=",")
|
|
property(name="$!win!EventData!CustomEventTag")
|
|
constant(value=",")
|
|
property(name="$!win!Event!Outcome")
|
|
constant(value="\n")
|
|
}
|
|
|
|
action(type="mmsnareparse")
|
|
action(type="omfile" file="'$RSYSLOG_OUT_LOG'" template="customfmt")
|
|
|
|
input(type="imtcp" port="0" listenPortFileName="'$RSYSLOG_DYNNAME'.tcpflood_port")
|
|
'
|
|
|
|
startup
|
|
|
|
assign_tcpflood_port "$RSYSLOG_DYNNAME.tcpflood_port"
|
|
tcpflood -m 1 -I "${srcdir}/testsuites/mmsnareparse/sample-custom-pattern.data"
|
|
|
|
shutdown_when_empty
|
|
wait_shutdown
|
|
|
|
content_check ',ZX-42,Demo,success' "$RSYSLOG_OUT_LOG"
|
|
|
|
rm -f "$DEF_FILE"
|
|
|
|
exit_test
|