decay / alienvault-pfsense Goto Github PK

Hello I'm facing some difficulties configuring the plugin to handle logs from pfSense.

I've try your pfsense.cfg file and it's not working.

My alien vault display like this

and my log sample is:
Apr 14 19:00:24 pfSense.home.arpa filterlog[60866] 4,,,1000000103,em1,match,block,in,4,0x0,,128,38934,0,none,1,icmp,60,192.168.100.3,10.0.2.1,request,1,2240

Could you help me ?

I am new to USM, but use pfSense firewalls so this will help me greatly.

One question, will this pose any problems since it shares a plugin ID and and SID with the existing pf plugin?

If used as is do I need to do anything to the database with a SQL file?

It looks like this is only matching the firewall portion of the pfsense syslog. pfSense has the option to run Snort and send Snort logs to syslog, would you be willing to look at an example of those logs to add to the plugin?

Snort syslog examples are below:

Nov 27 11:39:29 192.168.1.1 snort[76400]: [1:2017919:2] ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x03 [Classification: Attempted Denial of Service] [Priority: 2] {UDP} 23.94.144.234:42446 -> 104.128.98.200:123
Nov 27 12:14:44 192.168.1.1 snort[76400]: [1:2402001:3904] ET DROP Dshield Block Listed Source group 1 [Classification: Misc Attack] [Priority: 2] {UDP} 169.54.233.119:25533 -> 104.128.98.200:161

It looks to me like the fields are:
Date Time Device Hostname/IP process[pid?]:[gid?:sid?:???] Rule name [Classification] [Priority] {Proto} Source IP:source port -> Destination IP:destination port

I am not sure if that is the PID and am not sure what that is after the snort SID. I think that first number is the GID but again am not 100% sure.