Add support for NAXSI web application firewall

[kravietz]

Decoder will extract key alert information fields while the alert rule
will be triggered by both warnings (level 3) and blocked request alerts
(level 7)

[Lopuiz]

Hi @kravietz

Thank you for your contribution to the Ruleset project.
We will merge it as soon as possible.

Kind regards, Eva

[chemamartinez]

Hi @kravietz,

Both decoder and rules work fine.

Rule 31334

2013/11/10 07:36:19 [error] 8278#0: *5932 NAXSI_FMT: ip=X.X.X.X&server=Y.Y.Y.Y&uri=/phpMyAdmin-2.8.2/scripts/setup.php&learning=0&vers=0.52&total_processed=472&total_blocked=204&block=0&cscore0=$UWA&score0=8&zone0=HEADERS&id0=42000227&var_name0=user-agent, client: X.X.X.X, server: blog.memze.ro, request: "GET /phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1", host: "X.X.X.X"


**Phase 1: Completed pre-decoding.
       full event: '2013/11/10 07:36:19 [error] 8278#0: *5932 NAXSI_FMT: ip=X.X.X.X&server=Y.Y.Y.Y&uri=/phpMyAdmin-2.8.2/scripts/setup.php&learning=0&vers=0.52&total_processed=472&total_blocked=204&block=0&cscore0=$UWA&score0=8&zone0=HEADERS&id0=42000227&var_name0=user-agent, client: X.X.X.X, server: blog.memze.ro, request: "GET /phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1", host: "X.X.X.X"'
       timestamp: '(null)'
       hostname: 'ubuntu'
       program_name: '(null)'
       log: '2013/11/10 07:36:19 [error] 8278#0: *5932 NAXSI_FMT: ip=X.X.X.X&server=Y.Y.Y.Y&uri=/phpMyAdmin-2.8.2/scripts/setup.php&learning=0&vers=0.52&total_processed=472&total_blocked=204&block=0&cscore0=$UWA&score0=8&zone0=HEADERS&id0=42000227&var_name0=user-agent, client: X.X.X.X, server: blog.memze.ro, request: "GET /phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1", host: "X.X.X.X"'

**Phase 2: Completed decoding.
       decoder: 'nginx-errorlog'
       srcip: 'X.X.X.X'
       server: 'Y.Y.Y.Y'
       uri: '/phpMyAdmin-2.8.2/scripts/setup.php'
       learning: '0'
       vers: '0.52'
       total_processed: '472'
       total_blocked: '204'
       block: '0'
       attack: '$UWA'
       score: '8'

**Phase 3: Completed filtering (rules).
       Rule id: '31334'
       Level: '3'
       Description: 'NAXSI warning'
**Alert to be generated.

Rule 31335

2013/11/10 07:36:19 [error] 8278#0: *5932 NAXSI_FMT: ip=X.X.X.X&server=Y.Y.Y.Y&uri=/phpMyAdmin-2.8.2/scripts/setup.php&learning=0&vers=0.52&total_processed=472&total_blocked=204&block=1&cscore0=$UWA&score0=8&zone0=HEADERS&id0=42000227&var_name0=user-agent, client: X.X.X.X, server: blog.memze.ro, request: "GET /phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1", host: "X.X.X.X"


**Phase 1: Completed pre-decoding.
       full event: '2013/11/10 07:36:19 [error] 8278#0: *5932 NAXSI_FMT: ip=X.X.X.X&server=Y.Y.Y.Y&uri=/phpMyAdmin-2.8.2/scripts/setup.php&learning=0&vers=0.52&total_processed=472&total_blocked=204&block=1&cscore0=$UWA&score0=8&zone0=HEADERS&id0=42000227&var_name0=user-agent, client: X.X.X.X, server: blog.memze.ro, request: "GET /phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1", host: "X.X.X.X"'
       timestamp: '(null)'
       hostname: 'ubuntu'
       program_name: '(null)'
       log: '2013/11/10 07:36:19 [error] 8278#0: *5932 NAXSI_FMT: ip=X.X.X.X&server=Y.Y.Y.Y&uri=/phpMyAdmin-2.8.2/scripts/setup.php&learning=0&vers=0.52&total_processed=472&total_blocked=204&block=1&cscore0=$UWA&score0=8&zone0=HEADERS&id0=42000227&var_name0=user-agent, client: X.X.X.X, server: blog.memze.ro, request: "GET /phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1", host: "X.X.X.X"'

**Phase 2: Completed decoding.
       decoder: 'nginx-errorlog'
       srcip: 'X.X.X.X'
       server: 'Y.Y.Y.Y'
       uri: '/phpMyAdmin-2.8.2/scripts/setup.php'
       learning: '0'
       vers: '0.52'
       total_processed: '472'
       total_blocked: '204'
       block: '1'
       attack: '$UWA'
       score: '8'

**Phase 3: Completed filtering (rules).
       Rule id: '31335'
       Level: '7'
       Description: 'NAXSI rejected a query'
**Alert to be generated.

Thanks again for your contribution, it will be available for the next released version.