##################### # ### TESTSOFT.NET ### # ############################
### ArcSight Parser For Nginx and Bitrix Stock Logformat v1.0 ###
regex=(nginx):\\s(.*)
token.count=2
token[0].name=type
token[0].type=String
token[1].name=body
token[1].type=String
event.deviceVendor=__stringConstant("nginx")
event.deviceProduct=__stringConstant("webserver")
event.sourceUserPrivileges=__stringConstant("nginx")
event.deviceProcessName=__stringConstant("nginx")
event.flexString2=body
event.name=type
event.message=body
submessage.messageid.token=type
submessage.token=body
submessage.count=1
submessage[0].messageid=nginx
submessage[0].pattern.count=5
#1.1.1.1 - - [29/Aug/2020:15:38:17 -0400] "GET /test/test/ HTTP/1.1" 401 597 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 OPR/70.0.3728.106" "-" "-"
submessage[0].pattern[0].regex=(\\d+.\\d+.\\d+.\\d+)\\s+-\\s+(.*)\\s+\\[(.*)\\]\\s+\\"(\\w+)\\s+(.*)\\s+HTTP\\/\\d.\\d\\"\\s+(\\d+)\\s+(\\d+)\\s+\\"([^"]+)\\"\\s+\\"([^"]+)\\"\\s+\\"([^"]+)\\".*
submessage[0].pattern[0].mappings=$1|$2|$3|$4|$5|$6|$7|$8|$9|$10
submessage[0].pattern[0].fields=event.attackerAddress,event.targetUserName,event.deviceCustomString1,event.requestMethod,event.requestUrl,event.deviceCustomString2,event.bytesOut,event.deviceCustomString3,event.deviceCustomString4,event.deviceCustomString5
submessage[0].pattern[0].extramappings=event.deviceEventClassId\=__concatenate($4,":",$6)|event.message\=__concatenate($6," ",$4," ",$5)|event.deviceCustomString1Label=__stringConstant("time_local")|event.deviceCustomString2Label=__stringConstant("status")|event.deviceCustomString3Label=__stringConstant("http_referer")|event.deviceCustomString4Label=__stringConstant("http_user_agent")|event.deviceCustomString5Label=__stringConstant("http_x_forwarded_for")|event.deviceCustomString6Label=__stringConstant("http_x_forwarded_for")
#$1 - event.attackerAddress - $remote_addr
#$2 - event.targetUserName - $remote_user
#$3 - event.deviceCustomString1 - $time_local
#$4 - event.requestMethod -
#$5 - event.requestUrl -
#$6 - event.deviceCustomString2 - $status
#$7 - event.bytesOut - $body_bytes_sent
#$8 - event.deviceCustomString3 - $http_referer
#$9 - event.deviceCustomString4 - $http_user_agent
#$10 - event.deviceCustomString5 - $http_x_forwarded_for
#1.1.1.1 - - [29/Aug/2020:21:42:14 +0000] "\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 173 "-" "-" "-" "-"
submessage[0].pattern[1].regex=(\\d+.\\d+.\\d+.\\d+)\\s+-\\s+(.*)\\s+\\[(.*)\\]\\s+\\"(.*)\\"\\s+(\\d+)\\s+(\\d+)\\s+\\"([^"]+)\\"\\s+\\"([^"]+)\\"\\s+\\"([^"]+)\\".*
submessage[0].pattern[1].mappings=$1|$2|$3|$4|$5|$6|$7|$8|$9
submessage[0].pattern[1].fields=event.attackerAddress,event.targetUserName,event.deviceCustomString1,event.requestUrl,event.deviceCustomString2,event.bytesOut,event.deviceCustomString3,event.deviceCustomString4,event.deviceCustomString5
submessage[0].pattern[1].extramappings=event.deviceEventClassId\=__concatenate("-",":",$5)|event.message\=__concatenate($5," ","-"," ",$4)|event.deviceCustomString1Label=__stringConstant("time_local")|event.deviceCustomString2Label=__stringConstant("status")|event.deviceCustomString3Label=__stringConstant("http_referer")|event.deviceCustomString4Label=__stringConstant("http_user_agent")|event.deviceCustomString5Label=__stringConstant("http_x_forwarded_for")|event.deviceCustomString6Label=__stringConstant("http_x_forwarded_for")
#$1 - event.attackerAddress - $remote_addr
#$2 - event.targetUserName - $remote_user
#$3 - event.deviceCustomString1 - $time_local
#$4 - event.requestUrl -
#$5 - event.deviceCustomString2 - $status
#$6 - event.bytesOut - $body_bytes_sent
#$7 - event.deviceCustomString3 - $http_referer
#$8 - event.deviceCustomString4 - $http_user_agent
#$9 - event.deviceCustomString5 - $http_x_forwarded_for
######## NGINX STOCK ERROR ##########
#2020/08/29 04:44:28 [error] 5881#0: *93 user "admin": password mismatch, client: 1.1.1.1, server: usa-digital-2, request: "GET / HTTP/1.1", host: "1.1.1.1:80"
submessage[0].pattern[2].regex=(.*)\\s+\\[(\\w+)].*(user\\s\\"([^"]+)".*client:\\s(\\d+.\\d+.\\d+.\\d+)).*"(\\w+)\\s([^\\s]+).*".*
submessage[0].pattern[2].mappings=$1|$2|$3|$4|$5|$6|$7
submessage[0].pattern[2].fields=event.deviceCustomString1,event.deviceSeverity,event.message,event.targetUserName,event.attackerAddress,event.requestMethod,event.requestUrl
submessage[0].pattern[2].extramappings=event.name\=__concatenate("nginx"," ",$2)|event.deviceCustomString2=$2
#2020/09/24 16:12:21 [error] 27266#0: *3 open() "/usr/share/nginx/html/1111" failed (2: No such file or directory), client: 1.1.1.1, server: rus-just-2, request: "GET /1111 HTTP/1.1", host: "2.2.2.2"
submessage[0].pattern[3].regex=(.*)\\s+\\[(\\w+)]\\s+(.*)\\,\\s+client:\\s+(\\d+.\\d+.\\d+.\\d+).*request:\\s+\\"(\\w+)\\s+(.*)\\s+HTTP.*
submessage[0].pattern[3].mappings=$1|$2|$3|$4|$5|$6
submessage[0].pattern[3].fields=event.deviceCustomString1,event.deviceSeverity,event.message,event.attackerAddress,event.requestMethod,event.requestUrl
submessage[0].pattern[3].extramappings=event.name\=__concatenate("nginx"," ",$2)|event.deviceCustomString2=$2
######## ENF OF NGINX STOCK ERROR ##########
############ BITRIX NGINX STOCK ################
#1.1.1.1 - - [12/Sep/2020:13:24:09 +0300 - -] 200 "GET /bitrix/js/intranet/sidepanel/bindings/images/task_edit_bg.min.svg HTTP/1.1" 605 "http://1.1.1.1/bitrix/js/intranet/sidepanel/bindings/mask.min.css?159985698714512" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 OPR/70.0.3728.178" "-"
submessage[0].pattern[4].regex=(\\d+.\\d+.\\d+.\\d+)\\s+-\\s+(.*)\\s+\\[(.*)\\s+-\\s+(.*)\\]\\s+(\\d+)\\s+\\"(?:(\\w+)\\s+)?(.*)\\s+HTTP.*\\"\\s+(\\d+)\\s+"([^"]+)\\"\\s+\\"([^"]+)\\"\\s+\\"([^"]+)\\".*
submessage[0].pattern[4].mappings=$1|$2|$3|$4|$5|$6|$7|$8|$9|$10|$11
submessage[0].pattern[4].fields=event.attackerAddress,event.targetUserName,event.deviceCustomString1,event.deviceCustomString6,event.deviceCustomString2,event.requestMethod,event.requestUrl,event.bytesOut,event.deviceCustomString3,event.deviceCustomString4,event.deviceCustomString5
submessage[0].pattern[4].extramappings=event.deviceEventClassId\=__concatenate($6,":",$5)|event.message\=__concatenate($5," ",$6," ",$7)|event.deviceCustomString1Label=__stringConstant("time_local")|event.deviceCustomString2Label=__stringConstant("status")|event.deviceCustomString3Label=__stringConstant("http_referer")|event.deviceCustomString4Label=__stringConstant("http_user_agent")|event.deviceCustomString5Label=__stringConstant("http_x_forwarded_for")|event.deviceCustomString6Label=__stringConstant("upstream_response_time")|event.deviceProduct=__stringConstant("bitrix")
#$1 - event.attackerAddress - $remote_addr
#$2 - event.targetUserName - $remote_user
#$3 - event.deviceCustomString1 - $time_local
#$4 - event.deviceCustomString6 - $upstream_response_time
#$5 - event.deviceCustomString2 - $status
#$6 - event.requestMethod -
#$7 - event.requestUrl
#$8 - event.bytesOut - $body_bytes_sent
#$9 - event.deviceCustomString3 - $http_referer
#$10 - event.deviceCustomString4 - $http_user_agent
#$11 - event.deviceCustomString5 - $http_x_forwarded_for
############ END OF BITRIX NGINX STOCK ################
#submessage[1].pattern.count=1
#submessage[1].pattern[0].regex=(.*)
#submessage[1].pattern[0].fields=event.message
#submessage[1].pattern[0].extramappings=event.reason=__stringConstant("unparsed")
Arcsight flexConnector for Nginx with Bitrix
Posted on
