Decoders Syntax¶

Overview¶

Options¶

decoder¶

Each decoder must have its name defined for reference by rules and other decoders.

Attributes:

• name:

Example:

<decoder name="atomic-widget">

decoder.parent¶

A decoder may be the child of another decoder, offering further parsing. The child decoders will not be checked if the parent does not match the log message.

Example:

<decoder name="atomic-widget-login">
  <parent>atomic-widget</parent>

decoder.accumulate¶

New in version 2.9.0.

Allow OSSEC to track events over multiple log messages based on a decoded id.

<decoder name="example">
  ...
  <order>id</order>
  <accumulate/>
</decoder>

Note

Requires a regex populating the id field using regex or pcre2.

decoder.program_name¶

For many log messages a program name can be extracted automatically. This option compares the value with the decoded program_name value.

Allowed: Any OS_Match/sregex Syntax

Example:

<decoder name="atomic-widget">
  <program_name>atomic-widget</program_name>

decoder.program_name_pcre2¶

For many log messages a program name can be extracted automatically. This option compares the value with the decoded program_name value.

Allowed: A pcre2 compliant string to match the program_name.

decoder.prematch¶

prematch looks for a string to determine whether the decoder is applicable.

Allowed: Any OS_Match/sregex Syntax

decoder.prematch_pcre2¶

prematch uses pcre2 to look for a string to determine whether the decoder is applicable.

Allowed: A pcre2 compliant string.

decoder.regex¶

This option will allow parts of the log messages to be extracted into fields defined in the order option, using the OSSEC regex syntax.

Allowed: Any OS_Regex/regex Syntax

decoder.pcre2¶

This option will allow parts of the log messages to be extracted into fields defined in the order option, using the PCRE2 syntax.

Allowed: A pcre2 compliant search string.

decoder.order¶

This option names the fields used by the regex or pcre2 options. The field names are comma separated.

Field Name List:

• location - where the log came from (only on FTS)
• srcuser - extracts the source username
• dstuser - extracts the destination (target) username
• user - an alias to dstuser (only one of the two can be used)
• srcip - source ip
• dstip - dst ip
• srcport - source port
• dstport - destination port
• protocol - protocol
• id - event id
• url - url of the event
• action - event action (deny, drop, accept, etc)
• status - event status (success, failure, etc)
• extra_data - Any extra data

Active Response fields:

The following fields may be used for active responses.

• user
• srcip
• filename

decoder.fts¶

fts is the First Time Seen option inside of analysisd. It will alert the first time any defined decoded field is populated with a new value.

Allowed: Field names as listed in order above.

Example:

<decoder name="atomic-widget-login">
  <parent>atomic-widget</parent>
  <regex>user=(\S+)</regex>
  <order>srcuser</order>
  <fts>srcuser</fts>

decoder.ftscomment¶

Unused at this time.