3 /* Copyright (C) 2009 Trend Micro Inc.
6 * This program is a free software; you can redistribute it
7 * and/or modify it under the terms of the GNU General Public
8 * License (version 2) as published by the FSF - Free Software
19 #include "decoders/decoder.h"
22 /* Event Information structure */
23 typedef struct _Eventinfo
25 /* Extracted from the event */
33 /* Extracted from the decoders */
50 /* Pointer to the rule that generated it */
51 RuleInfo *generated_rule;
53 /* Pointer to the decoder that matched */
54 OSDecoderInfo *decoder_info;
56 /* Sid node to delete */
57 OSListNode *sid_node_to_delete;
59 /* Extract when the event fires a rule */
64 /* Other internal variables */
73 /* SYSCHECK Results variables -- only used by prelude for now */
92 /* Events List structure */
93 typedef struct _EventNode
96 struct _EventNode *next;
97 struct _EventNode *prev;
102 /* For test rule only. */
109 /** Types of events (from decoders) **/
110 #define UNKNOWN 0 /* Unkown */
111 #define SYSLOG 1 /* syslog messages */
112 #define IDS 2 /* IDS alerts */
113 #define FIREWALL 3 /* Firewall events */
114 #define WEBLOG 7 /* Apache logs */
115 #define SQUID 8 /* Squid logs */
116 #define WINDOWS 9 /* Windows logs */
117 #define HOST_INFO 10 /* Host information logs (from nmap or similar) */
118 #define OSSEC_RL 11 /* Ossec rules */
119 #define OSSEC_ALERT 12 /* Ossec Alerts */
122 /* FTS allowed values */
123 #define FTS_NAME 001000
124 #define FTS_SRCUSER 002000
125 #define FTS_DSTUSER 004000
126 #define FTS_SRCIP 000100
127 #define FTS_DSTIP 000200
128 #define FTS_LOCATION 000400
129 #define FTS_ID 000010
130 #define FTS_DATA 000020
131 #define FTS_SYSTEMNAME 000040
132 #define FTS_DONE 010000
135 /** Functions for events **/
137 /* Search for matches in the last events */
138 Eventinfo *Search_LastEvents(Eventinfo *lf, RuleInfo *currently_rule);
139 Eventinfo *Search_LastSids(Eventinfo *my_lf, RuleInfo *currently_rule);
140 Eventinfo *Search_LastGroups(Eventinfo *my_lf, RuleInfo *currently_rule);
142 /* Zero the eventinfo structure */
143 void Zero_Eventinfo(Eventinfo *lf);
145 /* Free the eventinfo structure */
146 void Free_Eventinfo(Eventinfo *lf);
148 /* Add and event to the list of previous events */
149 void OS_AddEvent(Eventinfo *lf);
151 /* Return the last event from the Event list */
152 EventNode *OS_GetLastEvent();
154 /* Create the event list. Maxsize must be specified */
155 void OS_CreateEventList(int maxsize);
158 /* Pointers to the event decoders */
159 void *SrcUser_FP(Eventinfo *lf, char *field);
160 void *DstUser_FP(Eventinfo *lf, char *field);
161 void *SrcIP_FP(Eventinfo *lf, char *field);
162 void *DstIP_FP(Eventinfo *lf, char *field);
163 void *SrcPort_FP(Eventinfo *lf, char *field);
164 void *DstPort_FP(Eventinfo *lf, char *field);
165 void *Protocol_FP(Eventinfo *lf, char *field);
166 void *Action_FP(Eventinfo *lf, char *field);
167 void *ID_FP(Eventinfo *lf, char *field);
168 void *Url_FP(Eventinfo *lf, char *field);
169 void *Data_FP(Eventinfo *lf, char *field);
170 void *Status_FP(Eventinfo *lf, char *field);
171 void *SystemName_FP(Eventinfo *lf, char *field);
172 void *None_FP(Eventinfo *lf, char *field);
176 #endif /* _EVTINFO__H */