2 - Racoon VPN rules for OSSEC HIDS.
3 - Author: Daniel B. Cid
4 - License: http://www.ossec.net/en/licensing.html
10 <group name="syslog,racoon,">
11 <rule id="14100" level="0">
12 <decoded_as>racoon</decoded_as>
13 <description>Grouping of racoon rules.</description>
16 <rule id="14101" level="5">
17 <decoded_as>racoon-failed</decoded_as>
18 <description>VPN authentication failed.</description>
19 <group>authentication_failed,</group>
22 <rule id="14110" level="0">
23 <if_sid>14100</if_sid>
25 <description>Racoon informational message.</description>
28 <rule id="14111" level="4">
29 <if_sid>14100</if_sid>
30 <action>ERROR</action>
31 <description>Racoon error message.</description>
34 <rule id="14112" level="4">
35 <if_sid>14100</if_sid>
36 <action>WARNING</action>
37 <description>Racoon warning message.</description>
40 <rule id="14120" level="3">
41 <if_sid>14110</if_sid>
42 <match>ISAKMP-SA established </match>
43 <group>authentication_success</group>
44 <description>VPN established.</description>
47 <rule id="14121" level="0">
48 <if_sid>14111</if_sid>
49 <match>such policy does not already exist</match>
50 <description>Roadwarrior configuration (ignored error).</description>
53 <rule id="14122" level="0">
54 <if_sid>14112</if_sid>
55 <match>ignore INITIAL-CONTACT notification</match>
56 <description>Roadwarrior configuration (ignored warning).</description>
59 <rule id="14123" level="0">
60 <if_sid>14111</if_sid>
61 <match>ERROR: invalid attribute|ERROR: rejected</match>
62 <description>Invalid configuration settings (ignored error).</description>
65 <rule id="14151" level="9" frequency="3" timeframe="360">
66 <if_matched_sid>14101</if_matched_sid>
68 <description>Multiple failed VPN logins.</description>
70 </group> <!-- SYSLOG,RACOON -->