Merge pull request #3 from atomicturtle/lighttpd

Adding lighttpd rules/decoders
ossec · Oct 7, 2020 · 33eec9c · 33eec9c
2 parents 387b66c + c33f2ae
commit 33eec9c
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/decoders.d/50-crs-lighttpd_decoder.xml b/decoders.d/50-crs-lighttpd_decoder.xml
@@ -0,0 +1,10 @@
+
+<!-- lighttpd.
+  - Examples:
+  - 2019-10-28 01:39:17: (connections-glue.c.200) SSL: 1 error:1417D18C:SSL routines:tls_process_client_hello:version too low
+  - 2019-10-29 05:24:27: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Fatal error:  Uncaught ErrorException: Unknown: [CLOSED] IMAP connection broken (server response) (errflg=1) in Unknown:0
+
+  -->
+<decoder name="lighttpd">
+  <prematch_pcre2>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d: \(</prematch_pcre2>
+</decoder>
diff --git a/rules.d/50-crs-lighttpd_rules.xml b/rules.d/50-crs-lighttpd_rules.xml
@@ -0,0 +1,8 @@
+<group name="local,lighttpd">
+  <rule id="56201" level="10">
+        <decoded_as>lighttpd</decoded_as>
+        <regex>fastcgi</regex>
+        <description>FastCGI error message.</description>
+  </rule>
+</group>
+