86 lines
3.5 KiB
XML
86 lines
3.5 KiB
XML
<!--
|
|
Regeln fuer den SSH-Pull-Betrieb (wird bei jedem Manager-Start nach etc/rules kopiert).
|
|
sshpull_fim: Datei-Integritaet aus manager/agentless/sshpull_integrity_linux
|
|
sshpull_status: Verbindungsstatus (Collector und Agentless-Checks)
|
|
-->
|
|
<group name="sshpull,">
|
|
|
|
<!-- ===== Datei-Integritaet ===== -->
|
|
<rule id="100500" level="0">
|
|
<decoded_as>json</decoded_as>
|
|
<field name="sshpull_fim.event">\.+</field>
|
|
<description>sshpull FIM-Ereignis</description>
|
|
</rule>
|
|
|
|
<rule id="100501" level="3">
|
|
<if_sid>100500</if_sid>
|
|
<field name="sshpull_fim.event">^baseline$</field>
|
|
<description>$(sshpull_fim.host): FIM-Baseline angelegt ($(sshpull_fim.files) Dateien)</description>
|
|
<group>sshpull_fim,</group>
|
|
</rule>
|
|
|
|
<rule id="100502" level="5">
|
|
<if_sid>100500</if_sid>
|
|
<field name="sshpull_fim.event">^added$</field>
|
|
<description>$(sshpull_fim.host): Datei hinzugefuegt: $(sshpull_fim.path)</description>
|
|
<group>sshpull_fim,syscheck_entry_added,pci_dss_11.5,gdpr_II_5.1.f,</group>
|
|
</rule>
|
|
|
|
<rule id="100503" level="7">
|
|
<if_sid>100500</if_sid>
|
|
<field name="sshpull_fim.event">^modified$</field>
|
|
<description>$(sshpull_fim.host): Datei geaendert ($(sshpull_fim.changed)): $(sshpull_fim.path)</description>
|
|
<group>sshpull_fim,syscheck_entry_modified,pci_dss_11.5,gdpr_II_5.1.f,</group>
|
|
</rule>
|
|
|
|
<rule id="100504" level="7">
|
|
<if_sid>100500</if_sid>
|
|
<field name="sshpull_fim.event">^deleted$</field>
|
|
<description>$(sshpull_fim.host): Datei geloescht: $(sshpull_fim.path)</description>
|
|
<group>sshpull_fim,syscheck_entry_deleted,pci_dss_11.5,gdpr_II_5.1.f,</group>
|
|
</rule>
|
|
|
|
<rule id="100505" level="10">
|
|
<if_sid>100500</if_sid>
|
|
<field name="sshpull_fim.event">^summary$</field>
|
|
<description>$(sshpull_fim.host): $(sshpull_fim.total) Dateiaenderungen auf einmal (neu $(sshpull_fim.added), geaendert $(sshpull_fim.modified), geloescht $(sshpull_fim.deleted)) - Update oder Kompromittierung?</description>
|
|
<group>sshpull_fim,</group>
|
|
</rule>
|
|
|
|
<rule id="100506" level="10">
|
|
<if_sid>100502,100503,100504</if_sid>
|
|
<field name="sshpull_fim.path" type="pcre2">^/etc/(passwd|shadow|group|gshadow|sudoers|ssh/sshd_config|pam\.d/)|^/etc/sudoers\.d/|/\.ssh/authorized_keys|^/etc/(crontab|cron\.d/)|^/etc/ld\.so\.preload$</field>
|
|
<description>$(sshpull_fim.host): Sicherheitskritische Datei $(sshpull_fim.event): $(sshpull_fim.path)</description>
|
|
<group>sshpull_fim,</group>
|
|
</rule>
|
|
|
|
<rule id="100507" level="10">
|
|
<if_sid>100502,100503</if_sid>
|
|
<field name="sshpull_fim.perm_after" type="pcre2">^[2-7][0-7]{3}$</field>
|
|
<description>$(sshpull_fim.host): Datei mit SUID/SGID-Bit ($(sshpull_fim.perm_after)): $(sshpull_fim.path)</description>
|
|
<group>sshpull_fim,</group>
|
|
</rule>
|
|
|
|
<!-- ===== Verbindungsstatus ===== -->
|
|
<rule id="100510" level="0">
|
|
<decoded_as>json</decoded_as>
|
|
<field name="sshpull_status.status">\.+</field>
|
|
<description>sshpull Statusmeldung</description>
|
|
</rule>
|
|
|
|
<rule id="100511" level="7">
|
|
<if_sid>100510</if_sid>
|
|
<field name="sshpull_status.status">^down$</field>
|
|
<description>$(sshpull_status.host): SSH-Abholung ($(sshpull_status.check)) gestoert: $(sshpull_status.message)</description>
|
|
<group>sshpull_status,</group>
|
|
</rule>
|
|
|
|
<rule id="100512" level="3">
|
|
<if_sid>100510</if_sid>
|
|
<field name="sshpull_status.status">^up$</field>
|
|
<description>$(sshpull_status.host): SSH-Abholung ($(sshpull_status.check)) wieder verbunden</description>
|
|
<group>sshpull_status,</group>
|
|
</rule>
|
|
|
|
</group>
|