logalyze how to add event definition

Question

I am working on logalyze, there is very limited documentation for this tool. I have done most of the things, but I am not able to add alerts.

Following is a sample xml file for event definition

<?xml version="1.0" encoding="UTF-8"?>
<tns:definitions xmlns:tns="http://logalyze.com" xmlns:xsi="http://www.w3.org   /2001/XMLSchema-instance" xsi:schemaLocation="http://logalyze.com http://repository.logalyze.com/logalyze-definitions-1.0.xsd ">
        <tns:eventdef version="1" id="a4151076-152c-11e1-91a4-0018de9d251b">
                <tns:name>Critical event Mod Sec</tns:name>
                <tns:description>Mod Sec</tns:description>
                <tns:vendor>LOGalyze</tns:vendor>
                <tns:group></tns:group>
                <tns:rule>SingleWithThreshold</tns:rule>
                <tns:criteria>
                        <tns:criterion>
                                <tns:field>_tag</tns:field>
                                <tns:operator>=</tns:operator>
                                <tns:value>mod_sec_warn</tns:value>
                        </tns:criterion>
                </tns:criteria>
                <tns:desc>3 login failures within 1m for user ${user_name}</tns:desc>
                <tns:window>60</tns:window>
                <tns:thresh>3</tns:thresh>
                <tns:actions>
                        <tns:action type="event">
                                <tns:prop>
                                        <tns:key>field:msg</tns:key>
                                        <tns:value>3 login failures within 1m for user ${user_name}</tns:value>
                                </tns:prop>
                                <tns:prop>
                                        <tns:key>field:user_name</tns:key>
                                        <tns:value/>
                                </tns:prop>
                                <tns:prop>
                                        <tns:key>field:loghostname</tns:key>
                                        <tns:value/>
                                </tns:prop>
                                <tns:prop>
                                        <tns:key>field:_priority</tns:key>
                                        <tns:value>high</tns:value>
                                </tns:prop>
                        </tns:action>
                </tns:actions>
        </tns:eventdef>
</tns:definitions>

Thanks Infosec.pk

Answer 1

So I should enhance the documentation of this :-)

You have one Action with type "event". This generates an artificial log entry, with logtype event with the field nem/value pairs in the prop list (msg, user_name, loghostname, _priority). This type of log than can be searched and can be an input of any other event definition.

To send an alert you have to use action type "mail". Properties of "mail" action are:

• to: email address
• subject: Defaule value is: 'LOGalyze alert'

The content of mail body will be generated by LOGalyze, currently you cannot modify it.