Users logging into unauthorized hosts

[JimHarbin]

Trying to write a correlated rule that can alert me when a user from one location logs into a server at another one of our locations..

User:   s0623jhn

Good hosts:  server1.0623.domain.com and server2.0623.domain.com

Bad hosts: server1.1821.domains.com or server1.0626.domain.com

So... how can pull the 4 digit number from the user name and compare it to the 4 digit location number in the correlated rule?  Do I have to pull this number into a cache variable and then compare it to a regex of the host name?

help...

[RSAAdmin]

I don't think that it is possible to do this...when comparing a difference in variables you would use the cache variabled.  When you want to gather events with similar values then you would multi-thread.

There are some other issues...hostname is usually the short part of the FQDN, so in your cases it would be server1 and server2.  The data you are looking at would be part of domain or domain name which would be 0623.domain.com.  Since you are comparing only the 4 digits and you can't use LIKE, NOT LIKE, or Regex with cache variables, I don't think you will be able to do this alert.

Now, if history is any indication, Matt will probably have a way that you can do this and reply to this post

Regards,

Paul

[RSAAdmin]

I'll reply, but I don't have a good solution at all. 

With no way to to do a cache variable comparison using the REGEX operator, there is no direct way to make the comparison with the numeric string in the middle of the username.

That said, if you can guarantee that the username is always in the format a0000aaa, where a is an alpha character and 0 is a numeric character, then you might be able to modify the actual device XML to strip out just the numbers.

The drawback to this is that you will no longer be able to read in the username as the full 8 character string.

[RSAAdmin]

I'll reply, but I don't have a good solution at all. 

With no way to to do a cache variable comparison using the REGEX operator, there is no direct way to make the comparison with the numeric string in the middle of the username.

That said, if you can guarantee that the username is always in the format a0000aaa, where a is an alpha character and 0 is a numeric character, then you might be able to modify the actual device XML to strip out just the numbers.

The drawback to this is that you will no longer be able to read in the username as the full 8 character string.