1 /* @(#) $Id: ./src/analysisd/eventinfo.h, 2011/09/08 dcid Exp $
4 /* Copyright (C) 2009 Trend Micro Inc.
7 * This program is a free software; you can redistribute it
8 * and/or modify it under the terms of the GNU General Public
9 * License (version 2) as published by the FSF - Free Software
20 #include "decoders/decoder.h"
23 /* Event Information structure */
24 typedef struct _Eventinfo
26 /* Extracted from the event */
34 /* Extracted from the decoders */
51 /* Pointer to the rule that generated it */
52 RuleInfo *generated_rule;
54 /* Pointer to the decoder that matched */
55 OSDecoderInfo *decoder_info;
57 /* Sid node to delete */
58 OSListNode *sid_node_to_delete;
60 /* Extract when the event fires a rule */
65 /* Other internal variables */
74 /* SYSCHECK Results variables */
91 /* Events List structure */
92 typedef struct _EventNode
95 struct _EventNode *next;
96 struct _EventNode *prev;
101 /* For test rule only. */
108 /** Types of events (from decoders) **/
109 #define UNKNOWN 0 /* Unkown */
110 #define SYSLOG 1 /* syslog messages */
111 #define IDS 2 /* IDS alerts */
112 #define FIREWALL 3 /* Firewall events */
113 #define WEBLOG 7 /* Apache logs */
114 #define SQUID 8 /* Squid logs */
115 #define DECODER_WINDOWS 9 /* Windows logs */
116 #define HOST_INFO 10 /* Host information logs (from nmap or similar) */
117 #define OSSEC_RL 11 /* Ossec rules */
118 #define OSSEC_ALERT 12 /* Ossec Alerts */
121 /* FTS allowed values */
122 #define FTS_NAME 001000
123 #define FTS_SRCUSER 002000
124 #define FTS_DSTUSER 004000
125 #define FTS_SRCIP 000100
126 #define FTS_DSTIP 000200
127 #define FTS_LOCATION 000400
128 #define FTS_ID 000010
129 #define FTS_DATA 000020
130 #define FTS_SYSTEMNAME 000040
131 #define FTS_DONE 010000
134 /** Functions for events **/
136 /* Search for matches in the last events */
137 Eventinfo *Search_LastEvents(Eventinfo *lf, RuleInfo *currently_rule);
138 Eventinfo *Search_LastSids(Eventinfo *my_lf, RuleInfo *currently_rule);
139 Eventinfo *Search_LastGroups(Eventinfo *my_lf, RuleInfo *currently_rule);
141 /* Zero the eventinfo structure */
142 void Zero_Eventinfo(Eventinfo *lf);
144 /* Free the eventinfo structure */
145 void Free_Eventinfo(Eventinfo *lf);
147 /* Add and event to the list of previous events */
148 void OS_AddEvent(Eventinfo *lf);
150 /* Return the last event from the Event list */
151 EventNode *OS_GetLastEvent();
153 /* Create the event list. Maxsize must be specified */
154 void OS_CreateEventList(int maxsize);
157 /* Pointers to the event decoders */
158 void *SrcUser_FP(Eventinfo *lf, char *field);
159 void *DstUser_FP(Eventinfo *lf, char *field);
160 void *SrcIP_FP(Eventinfo *lf, char *field);
161 void *DstIP_FP(Eventinfo *lf, char *field);
162 void *SrcPort_FP(Eventinfo *lf, char *field);
163 void *DstPort_FP(Eventinfo *lf, char *field);
164 void *Protocol_FP(Eventinfo *lf, char *field);
165 void *Action_FP(Eventinfo *lf, char *field);
166 void *ID_FP(Eventinfo *lf, char *field);
167 void *Url_FP(Eventinfo *lf, char *field);
168 void *Data_FP(Eventinfo *lf, char *field);
169 void *Status_FP(Eventinfo *lf, char *field);
170 void *SystemName_FP(Eventinfo *lf, char *field);
171 void *None_FP(Eventinfo *lf, char *field);
175 #endif /* _EVTINFO__H */