Rules Syntax¶

rule¶

<rule> is the label that starts the block that defines a rule. In this section the different options to this label are explained.

Example:

<!--- Rule definition -->
<rule id="100001" maxsize="300" level="3">
  ...
</rule>

In this example, the rule is assigned with the ID 100001, a maximum size of each event of 300 characters and the rule level in 3.

match¶

Any string to match against the log event.

Example:

<rule id="100001" maxsize="300" level="3">
  <if_sid>100200</if_sid>
  <match>Queue flood!</match>
  <description> Flooded events queue.</description>
</rule>

If the rule matches the id 100200 that contains the Queue flood! phrase in it, rule activates and sends an event.

regex¶

Any regex to match against the log event.

Example:

regex is used to find a variety of strings in a rule. For example, if we want to match any valid IP:

<rule id="100001" level="3">
  <if_sid>10050</if_sid>
  <regex>^(\d+.\d+.\d+.\d+)$</regex>
  <description>Matches any valid IP</description>
</rule>

decoded_as¶

category¶

Selects in which rule decoding category the rule should be included: ids, syslog, firewall, web-log, squid or windows.

field¶

Any OS_Regex to be compared to a field extracted by the decoder.

srcip¶

Any IP address or CIDR block to be compared to an IP decoded as srcip. Use “!” to negate it.

dstip¶

Any IP address or CIDR block to be compared to an IP decoded as dstip. Use “!” to negate it.

extra_data¶

Any string that is decoded into the extra_data field.

user¶

Any username (decoded as the username).

program_name¶

Program name is decoded from syslog process name.

hostname¶

Any hostname (decoded as the syslog hostname) or log file.

time¶

Time that the event was generated.

weekday¶

Week day that the event was generated.

id¶

Any ID (decoded as the ID).

url¶

Any URL (decoded as the URL).

location¶

The event extended location of the incoming event.

The location identifies the origin of the input. If the event comes from an agent, its name and registered IP (as it was added) is appended to the location.

Example of a location for a log pulled from “/var/log/syslog” in an agent with name “dbserver” and registered with IP “any”:

(dbserver) any->/var/log/syslog

The following components use a static location:

action¶

Any action (decoded as the ACTION).

if_sid¶

Matches if the ID has matched.

if_group¶

Matches if the group has matched before.

if_level¶

Matches if the level has matched before.

if_matched_sid¶

Matches if an alert of the defined ID has been triggered in a set number of seconds.

This option is used in conjunction with frequency and timeframe.

if_matched_group¶

Matches if an alert of the defined group has been triggered in a set number of seconds.

This option is used in conjunction with frequency and timeframe.

if_fts¶

Makes the decoder that processed the event to take the fts line into consideration.

same_id¶

Specifies that the decoded id must be the same. This option is used in conjunction with frequency and timeframe.

same_source_ip¶

Specifies that the decoded source ip must be the same. This option is used in conjunction with frequency and timeframe.

same_src_port¶

Specifies that the decoded source port must be the same. This option is used in conjunction with frequency and timeframe.

same_dst_port¶

Specifies that the decoded destination port must be the same. This option is used in conjunction with frequency and timeframe.

same_location¶

Specifies that the location must be the same. This option is used in conjunction with frequency and timeframe.

same_user¶

Specifies that the decoded user must be the same. This option is used in conjunction with frequency and timeframe.

same_field¶

Specifies that the decoded field must be the same as the previous one. This option is used in conjunction with frequency and timeframe.

As an example of this option, check this rule:

<rule id="100001" level="3">
  <if_sid>221</if_sid>
  <field name="netinfo.iface.name">ens33</field>
  <description>Testing interface alert</description>
</rule>

<rule id="100002" level="7" frequency="3" timeframe="300">
  <if_matched_sid>100001</if_matched_sid>
  <same_field>netinfo.iface.mac</same_field>
  <description>Testing options for correlating repeated fields</description>
</rule>

not_same_field¶

Specifies that the decoded field must be different than the previous one. This option is used in conjunction with frequency and timeframe.

As an example of this option, check this rule:

<rule id="100001" level="3">
  <if_sid>221</if_sid>
  <field name="netinfo.iface.name">ens33</field>
  <description>Testing interface alert</description>
</rule>

<rule id="100002" level="7" frequency="3" timeframe="300">
  <if_matched_sid>100001</if_matched_sid>
  <not_same_field>netinfo.iface.mac</not_same_field>
  <description>Testing options for correlating repeated fields</description>
</rule>

different_url¶

Specifies that the decoded url must be different. This option is used in conjunction with frequency and timeframe.

different_srcgeoip¶

Specifies that the source geoip location must be different. This option is used in conjunction with frequency and timeframe.

Example:

As an example to this last options, check this rule:

<rule id=100005 level="0">
  <match> Could not open /home </match>
  <same_user />
  <different_srcgeoip />
  <same_dst_port />
</rule>

That rule filters when the same user tries to open file /home but returns an error, on a different ip and using same port.

description¶

Specifies a human readable description to the rule in order to provide context to each alert regarding the nature of the events matched by it. This field is required.

Examples:

<rule id="100015" level="2">
  ...
  <description> A timeout occurred. </description>
</rule>

<rule id="100035" level="4">
  ...
  <description> File missing. Root acces unrestricted. </description>
</rule>

Since Wazuh version 3.3 it is possible to include any decoded field (static or dynamic) to the description message. You can use the following syntax: $(field_name) to add a field to the description.

Example:

<rule id="100005" level="8">
  <match>illegal user|invalid user</match>
  <description>sshd: Attempt to login using a non-existent user from IP $(attempt_ip)</description>
  <options>no_log</options>
</rule>

list¶

Perform a CDB lookup using an ossec list. This is a fast on disk database which will always find keys within two seeks of the file.

info¶

Extra information may be added through the following attributes:

options¶

Additional rule options.

Example:

<rule id="9800" level="8">
  <match>illegal user|invalid user</match>
  <description>sshd: Attempt to login using a non-existent user</description>
  <options>no_log</options>
</rule>

check_diff¶

Used to determine when the output of a command changes.

group¶

Add additional groups to the alert. Groups are optional tags added to alerts.

They can be used by other rules by using if_group or if_matched_group, or by alert parsing tools to categorize alerts.

Groups are variables that define a behavior. When an alert includes that group label, this behavior will occur.

Example:

<rule id="3801" level="4">
  <description>Group for rules related with spam.</description>
  <group>spam,</group>
</rule>

Now, every rule with the line <group>spam,</group> will be included in that group.

It’s a very useful label to keep the rules ordered.

status¶

Declares the actual status of a rule.

var¶

Defines a variable that may be used in any place of the same file.

Example:

 <var name="joe_folder">/home/joe/</var>

  <group name="local,">

    <rule id="100001" level="5">
      <if_sid>550</if_sid>
      <field name="file">^$joe_folder</field>
      <description>A Joe's file was modified.</description>
      <group>ossec,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
    </rule>

</group>

BAD_WORDS¶

<var name=”BAD_WORDS”>error|warning|failure</var>

BAD_WORDS is a very used use case of <var> option.

Is used to include many words in the same variable. Later, this variable can be matched into the decoders to check if any of those words are in a caught event.

Example:

<var name="BAD_WORDS">error|warning|failure</var>

<group name="syslog,errors,">
  <rule id="XXXX" level="2">
    <match>$BAD_WORDS</match>
    <description>Error found.</description>
  </rule>
</group>