Интеграция с Сканером ВС 6.0

Отправка событий по протоколу Syslog в KOMRAD

Предварительные условия:

Порядок настройки в сканер ВС 6.0:

Откройте файл конфигурации Сканера

nano /etc/echelon/scanner/scanner.yaml

В конце файла укажите адрес KOMRAD:

syslogger:

    - sink: "syslog:tcp://IP_KOMRAD:49000"
      levels:

          - all

Выполните перезапуск сервиса.

sudo systemctl restart scanner

После выполнения вышеуказанных действий вы увидите приходящие события в KOMRAD.

Регулярное выражение для нормализации событий со сканера
<\d+>.*{.*\"hostname\"\:\"(?P<a>.*?)\"\,\"id\"\:\"(?P<b>.*?)\"\,\"ip\"\:\"(?P<c>\d+\.\d+\.\d+\.\d+)\"\,\"mac\"\:\"(?P<d>.*?)\"\,\"type\"\:\"(?P<o>.*?)\"\,\"uptime\"\:\"(?P<n>.*?)\"\,\"architecture\"\:\"(?P<m>.*?)\"\,\"domain\"\:\"(?P<l>.*?)\"\,\"cpu.usage\"\:\"(?P<p>.*?)\"\,\"disk.read.bytes\"\:\"(?P<q>.*?)\"\,\"disk.write.bytes\"\:\"(?P<r>.*?)\"\,\"network.ingress.bytes\"\:\"(?P<s>.*?)\"\,\"network.ingress.packets\"\:\"(?P<t>.*?)\"\,\"network.egress.bytes\"\:\"(?P<u>.*?)\"\,\"network.egress.packets\"\:\"(?P<mv>.*?)\".*vuln.*classification\"\:\"(?P<e>.*?)\"\,\"enumeration\"\:\"(?P<f>.*?)\"\,\"reference\"\:\"(?P<w>.*?)\"\,\"score\.base\"\:\"(?P<g>.*?)\"\,\"score.temporal\"\:\"(?P<h>.*?)\"\,\"score.environmental\"\:\"(?P<i>.*?)\"\,\"score.version\"\:\"(?P<j>.*?)\"\,\"category\"\:\"(?P<x>.*?)\"\,\"description\"\:\"(?P<aa>.*?)\"\,\"id\"\:\"(?P<y>.*?)\"\,\"scanner.vendor\"\:\"(?P<z>.*?)\"\,\"severity\"\:\"(?P<bb>.*?)\"\,\"\w+\"\:\"(?P<k>.*?)\"}}
Пример исходного события
<134>1 2023-04-27T08:47:52.866111+03:00 scanner-monitoring /usr/bin/scanner 3900 - - {{"logger":"vuln","msg":"","host":{"hostname":"akvs3-build-u18","name":"akvs3-build-u18 (10.0.5.133)","id":"gfghj","ip":"10.0.5.133","mac":"fgh","type":"unspecified","uptime":"fghfh","architecture":"hdth","domain":"dthdth","cpu.usage":"dthd","disk.read.bytes":"dthdth","disk.write.bytes":"dthd","network.ingress.bytes":"dhth","network.ingress.packets":"dhth","network.egress.bytes":"dth","network.egress.packets":"dthtdh"},"vuln":{"classification":"CVSS3","enumeration":"CVE","reference":"dthdt","score.base":"7.500000","score.temporal":"dtht","score.environmental":"dhtdh","score.version":"dthdt","category":"dthdth","description":"The FTP (aka \"Implementation of a simple FTP client and server\") project through 96c1a35 allows remote attackers to cause a denial of service (memory consumption) by engaging in client activity, such as establishing and then terminating a connection. This occurs because malloc is used but free is not.","id":"CVE-2023-22551","scanner.vendor":"dthd","severity":"high","report_id":"39"}}