Cisco-IOS decoder for EMWEB-3-LOGIN_FAILED events

[maumrsms]

Wazuh version	Component	Action type
4.3.6	Rules/Decoders	New

Description

Hello team! I recently needed to work on decoding the user on next event from Cisco-IOS:
%EMWEB-3-LOGIN_FAILED: ews_auth.c:1234 Login failed for the user:USERNAME_HERE. Service-Type is not present or it doesn't allow READ/WRITE permission..

So I created next decoder to do so:

<decoder name="cisco-ios-login-failed">
  <parent>cisco-ios</parent>
  <prematch>%EMWEB-3-LOGIN_FAILED: \S+ Login failed for the user:\S+.</prematch>
  <regex>%(\w+)-(\d)-(\w+): \S+ Login failed for the user:(\S+).</regex>
  <order>cisco.facility, cisco.severity, cisco.mnemonic, srcuser</order>
</decoder>

The only thing to consider is that I needed to add it right before the last decoder in /var/ossec/ruleset/decoders/0065-cisco-ios_decoders.xml for it to work.

Service/Product/Module

cisco-ios.

Errors/Improvements

Current results

**Phase 2: Completed decoding.
       decoder: 'cisco-ios'
       cisco.facility: 'EMWEB'
       cisco.severity: '3'
       cisco.mnemonic: 'LOGIN_FAILED'

**Phase 3: Completed filtering (rules).
       Rule id: '4713'
       Level: '4'
       Description: 'Cisco IOS error message - LOGIN_FAILED'
**Alert to be generated.

Expected results

**Phase 2: Completed decoding.
       decoder: 'cisco-ios'
       cisco.facility: 'EMWEB'
       cisco.severity: '3'
       cisco.mnemonic: 'LOGIN_FAILED'
       srcuser: 'pdelaquintana'

**Phase 3: Completed filtering (rules).
       Rule id: '4713'
       Level: '4'
       Description: 'Cisco IOS error message - LOGIN_FAILED'
**Alert to be generated.

Resources

Log source / integration

cisco-ios via syslog

Log reference

• https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/www.cisco.com/content/en/us/td/docs/wireless/controller/7-6/message/guide/sysmsg76/emt_emweb_ethoip_msgs10.html.xml
• https://community.cisco.com/t5/wireless/wlc-administrator-login-problem/m-p/1022773

Log examples

%EMWEB-3-LOGIN_FAILED: ews_auth.c:1234 Login failed for the user:USERNAME_HERE. Service-Type is not present or it doesn't allow READ/WRITE permission..