Mapping syslog severity and action

severity_map — Severity displays as a value between 1 (least severe) and 100 (most severe) assigned to events matching the rule. The device sending the message might show severity as a number 1–10, or as text (high, medium, low). When this happens, it can't be captured as the severity so a mapping must be created. For example, here is a message coming from Trellix IntruShield that shows severity in text form.

<113>Apr 21 07:16:11 SyslogAlertForwarder: Attack NMAP: XMAS Probe (Medium)\000

Rule syntax using severity mapping would look like this (severity mapping is in bold for emphasis only):

alert any any any -> any any (msg:"Host_Name Traffic"; content:"syslogalertforwarder"; severity_map:High=99,Medium=55,Low=10; pcre:"(SyslogAlertForwarder)\x3a\s+Attack\s+([^\x27]+)\x27([^\x28]+)\x28"; raw; setparm:application=1; setparm:msg=2; setparm:severity=3; adsid:190; rev:1;)

severity_map: High=99,Medium=55,Low=10. This maps the text to a number in the format we can use.

setparm: severity=3. This says to take the third capture and set it equal to the severity. All setparm modifiers work this way.

action_map — Used just like severity. Action represents the action the third-party device took. The goal with action is to create a mapping that is useful to the end user. For example, here is a failed logon message from OpenSSH.

Dec 6 10:27:03 nina sshd[24259]: Failed password for root from 10.0.12.20 port 49547 ssh2

alert any any any -> any any (msg:"SSH Login Attempt"; content:"sshd"; action_map:Failed=9,Accepted=8;

pcre:"sshd\x5b\d+\x5d\x3a\s+((Failed|Accepted)\s+password)\s+for\s+((invalid|illegal)\s+user\s+)?(\S+)\s+from\s+(\S+)(\s+(\S+)\s+port\s+(\d+))?"; raw; setparm:msg=1; setparm:action=2; setparm:username=5; setparm:src_ip=6; adsid:190; rev:1;)

The action (Failed) is mapped to a number. This number represents the different actions we can use in our system. Below is the full list of usable action types.

In this example, Failed is mapped from the syslog message to 9, which the system reports as Failure.

Here is a breakdown of the structure for a rule.

Alert any any any -> any any (msg:”Login Attempt”; content:”sshd”; action_map or severity_map (if you need it); pcre:”your regular expression goes here”; raw; setparm:data_tag_goes_here; adsid:190; rev:1;)