Fix alert email sending when no_full_log option is set in a rule#3174
Merged
chemamartinez merged 20 commits into3.10from Aug 28, 2019
Merged
Fix alert email sending when no_full_log option is set in a rule#3174chemamartinez merged 20 commits into3.10from
chemamartinez merged 20 commits into3.10from
Conversation
Contributor
Author
|
Contributor
Author
|
I've also compiled the Wazuh server with
|
Contributor
Author
|
I added the inclusion of the full JSON alert when |
Contributor
|
Hi team! I add a new commit to modify an email alert format. Both Some email examples are: And netstat listening ports rule: Regards, |
Contributor
|
Hi! The Windows Eventchannel alerts will show as follows: And Sysmon rule with And this is how you see some alerts in the same message: Regards, |
Contributor
|
Hello team! Following examples are Syscheck alert emails: And this is how you see two Syscheck alerts in the same message: And this is how you see two Windows Syscheck alerts: Regards, |
chemamartinez
requested review from
chemamartinez
and removed request for
albertomn86 and
bah07
chemamartinez
suggested changes
Aug 23, 2019
| { | ||
| int i = 0, sms_set = 0, donotgroup = 0; | ||
| size_t body_size = OS_MAXSTR - 3, log_size; | ||
| size_t *body_size = malloc(sizeof(size_t)), log_size; |
Contributor
There was a problem hiding this comment.
Use os_malloc() instead of calling malloc directly. Same for the others occurrences.
| if (!(rule = cJSON_GetObjectItem(al_json, "rule"), rule && (mail_flag = cJSON_GetObjectItem(rule, "mail"), mail_flag && cJSON_IsTrue(mail_flag)))) | ||
| goto end; | ||
|
|
||
|
|
Contributor
There was a problem hiding this comment.
Remove this whiteline
| // Add alert to logs | ||
| char *tab = malloc(14*sizeof(char)); | ||
| strcpy(tab, "\t"); | ||
| cJSON_PrintTable(al_json, logs, body_size, tab, 2); |
Contributor
There was a problem hiding this comment.
Change the name of the function. cJSON_X() can lead to a think it belongs to the cJSON library.
| { | ||
| char *val1 = NULL, *val2 = NULL; | ||
| int log_size; | ||
| char *t = malloc(14*sizeof(char)); |
Contributor
There was a problem hiding this comment.
It's the maximum number of times it can be tabulated.
| char *val1 = NULL, *val2 = NULL; | ||
| int log_size; | ||
| char *t = malloc(14*sizeof(char)); | ||
| strcpy(t, tab); |
| } | ||
| } | ||
|
|
||
| if(dep < 12){ |
Contributor
There was a problem hiding this comment.
dep refers to the depth of the search in the incoming JSON? If so, it should not be limited.
Contributor
There was a problem hiding this comment.
It's the number of times it's been tabulated. I have modified the variable name so that there is no confusion.
Contributor
|
Hi! It needs a new review. I have added changes requested, and fixed invalid read and invalid free. I attach Valgrind log file: Regards, |
Contributor
|
Hello team! I've added the following modifications:
If Syscheck alert hasn't This change is due that when Syscheck alert has As shown, Sha1sum, Sha256sum, and Md5sum are duplicated.
Test Valgrind: Regards, |
Contributor
|
Hi! Also, I attach Eventchannel alerts: Regards, |
Contributor
|
Defects found by building with
|
chemamartinez
suggested changes
Aug 27, 2019
Contributor
There was a problem hiding this comment.
Let's continue using Portion of the log(s), in many cases is the full_log field the printed data.
Contributor
There was a problem hiding this comment.
Why counter should be less than 12? We have to allow more tabs by default.
Contributor
There was a problem hiding this comment.
Add the explicit check of the json_field content. Some gcc versions complain about this:
os_maild/os_maild_client.c: In function ‘OS_RecvMailQ_JSON’:
os_maild/os_maild_client.c:389:8: warning: suggest parentheses around assignment used as truth value [-Wparentheses]
if(json_field = cJSON_GetObjectItem(al_json,"full_log")){
^~~~~~~~~~
By adding:
if(json_field = cJSON_GetObjectItem(al_json,"full_log"), json_field){
we avoid the error
Contributor
There was a problem hiding this comment.
Same as above:
else if (json_object = cJSON_GetObjectItem(al_json,"syscheck"), json_object){
Contributor
There was a problem hiding this comment.
Same:
while(json_array = cJSON_GetArrayItem(item, i), json_array){
Contributor
There was a problem hiding this comment.
Define log_size as size_t to avoid these errors:
os_maild/os_maild_client.c:808:31: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
if (body_size > log_size) {
Author: DaveVG1 <vgdavid91@gmail.com> Committer: DaveVG1 <vgdavid91@gmail.com>
chemamartinez
force-pushed
the
fix-email-log-option
branch
from
2c2fbf6 to
cdde86f
Compare
Contributor
|
Hi! I've subjected Maild generates about 12 emails per second. Regards, |
chemamartinez
approved these changes
Aug 28, 2019
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This fixes #3163 and #3762
Fix
no_full_logoption weren't working.Testing
Rule configuration
This rule has been included in
/var/ossec/etc/rules/local_rules.xml:To trigger the alert that matches this rule the following log has been concatenated to
/var/log/syslog(Ubuntu):Valgrind report
Result
An alert mail that's been triggered by a rule that has the
no_full_logoption, now look like this: