XP Firewall Custom Parser

Now before i start, NO NO NO i do not recommend configuring this on all the desktops in your network!

I have created this parser basically as a sample exercise, for those people getting to know MARS, and the custom parser functionality.


Without having to have vendor X,Y,Z`s appliance or application on the network etc, you can simply install the PNLog Agent on your XP machine (sorry no Vista, i`ve refrained for now, due to colleagues screams in the office), create the simple parser, and test the functionality.

This is available in the MARS User Group Files Section, and i`ll provide a direct link next week.

Windows Event Logging

The next few articles i`m looking to publish are regarding getting information from Microsoft Windows Hosts.

By this i mean getting MARS to process data pulled from the application, system and security event logs, whether from a server or workstation.

Information regarding pulling other logs from Windows servers, will follow in later articles.

Now we can use 2 methods to retrieve event logs from a Windows Host. Either we tell MARS to pull the events from the host or we configure the host to send the event data to the MARS appliance, but NOT both at the same time.

The decision on what method to use, depends on a few factors, namely whether to install an agent on the host, the desired load on the MARS appliance, and how near real-time we want the event data that MARS will process.

Some of the major differences....

A) Use an Agent (Pushes info to MARS via Syslog)

1. Takes up Host CPU and Memory
2. More efficient in terms of resource utilization on the MARS Appliance itself
3. Agents allow real-time reporting of events (event by event)
4. Allows all Event Logs to be sent to MARS; however requires customer
parsing for logs other that Security Events & select MS Application events
5. A freeware version is available.. Snare (Intersect Alliance) - Support can be purchased

The SNARE application for example, (shown below) interfaces with the Windows event logging sub-system to read the logs, filter according to a set of administrator defined objectives, and then sends via syslog to MARS.

B) No Agent (Pull method via RPC)

1. Less administration overhead.
2. Can be configured for Global Access to all devices with 1 AD Account.
3. Scheduled Access to Security Event Logs only (Not real-time), default is 5 minutes interval.
4. Allows you selectively choose what Security Events to be logged via Windows Security Policies - Audit Policies
5. Can restrict access to the device for MARS for the Security Events only via Windows AD Security Policies, does not require full admin access rights.
6. Operates in a single process on the MARS device, completing the pull from one device before moving to the next. As a result it may take much longer to cycle through all of the reporting devices as the number of devices grows.

C) No Agent (Push method via SNMP)

1. Real time logging of event data
2. Allow all Event Logs to be sent to MARS
3. Requires Custom Parsing for MARS to understand log data, since in SNMP format
4. Lower Resource Impact than an Agent

Typically a Microsoft tool like Evntcmd could be used, but there also Agent based systems for sending the Windows Event logs via SNMP.

One recommendation is to have all your windows devices report to a DC/PDC and pull or push the Domain Event logs from there, so you are effectively pulling the information from one machine, rather than several.

Using this model, you leverage windows security policies to dictate what is sent to the MARS appliance. This is more scalable in terms of Management and Configuration.

And finally in upcoming articles, i`ll show how what events we should be logging, and how we can run reports and create rules on this information.

Cisco NAC Appliance Custom Parser

Following on from the recent Custom Parser demos, I am very pleased to be able to provide this great CS-MARS custom parser guide for the Cisco NAC Appliance, or Clean Access as it was previously known.

Many thanks to the author, a CSE out of Ohio named Craig Hyps, for allowing this to be published.

Cisco Systems TAC supports the custom parser functionality; however, it does not support or provide assistance in building or troubleshooting custom parsers.

As i`ve previously said, i`m keen to share Parsers in the Cisco MARS User Group, and this is one file i have recently uploaded.

nProbe with Cisco MARS

Ok following on from the previous post. This is another probably not supported, but probably possible article.

I`m not afraid to mix open source tools with commercial products, and this follows on from some testing on the Netflow front.

Not everyone has a netflow capable switch or router on the network, and similarly the following can be achieved just as easily with a snort sensor, or Cisco IPS/3rd party supported IDS/IPS Sensor, (the better options) and is purely for reference.

There are open source tools available, that will simply sniff the network, via a tap/span port, and spit this out in Netflow.

One such tool is nProbe, which is a An Extensible NetFlow v5/v9/IPFIX GPL Probe for IPv4/v6.

And there are others too for instance NDSAD. But for my testing i used nProbe.

Now we can simply send the Netflow records to MARS, and MARS will process these.

Now remember from yesterday, it is not recommended to store Netflow records, and i`ve not come across anyone who does, but for this testing i did enable this feature.

What happens now? Well MARS starts to store this data, and also sessionize it too, so we can run queries, but they are of the unknown event type...

and similarly looking at an individual session

and an example raw event message

You will also probably find, that in the CLI pnlog show backend command, you will some errors like the following...

Mar 29 09:59:11.194 2007@localhost@1980@LM_ERROR@./pnparser|Thread 15376:Netflow device with IP '192.168.2.34' is not configured in the GUI.

So how would we get MARS to recognise these events, when nProbe isnt listed on the supported device types? Well this was down to trial and error, but i found if i defined the nProbe box as an IOS device, this worked a treat.

You will get an obvious error, when this is submitted, and there was no SNMP available from my nProbe box, but this can be ignored,

Now when any queries are run, you will find, that MARS was able to sessionize these events forwarded by nProbe successfully (well at least the traffic i captured)

and similarly the session and raw event information.


As a final note, remember this is a very inefficient use of the MARS box`s resources, so it would not be recommended on a large production network!

So dont be blaming me!, if you ever try it out. :-)

Netflow from a HP Switch?

I was at a MARS meeting with a potential customer the other day, and it was one of those meetings where all is going great, the customer loves the idea of what MARS can do, and then we get onto what devices the customer has in their network.

Ok, HP Switches across the board, some 3rd party firewall in a DC that they are not allowed to touch, no IDS/IPS in place or any plans/skills for etc.. if you`ve been there you will know!

Coming home from the meeting got me thinking.

I know most high end HP switches can export Sflow, as opposed to Netflow that is supported by MARS.

Now what if there was a tool that could convert Sflow to Netflow?, at least we would be able to get some useful info into MARS, for anomaly detection at least.

Remember, MARS does not store netflow by default, only the records that are part of an incident. But you do get the option to store Netflow, though this is not recommended! (This has the potential of slowing the system by drastically increasing the events per second that it must process.)



Now i have not tried the following, or do i recommend it (i dont even have a Sflow supported HP Switch), nor do know if it would be supported by MARS, but here is the theory!
There is a tool called the Sflow Toolkit, by a company called InMon

This runs on Linux, Solaris or Windows, and will take Sflows and convert them to Netflow, to forward onto a Netflow collector such as MARS.

The following example shows sflowtool converting sFlow packets into NetFlow and sending the NetFlow packets to a NetFlow collector specified by a host and port.


sflowtool -c netflow.inmon.com -d 9991 > /dev/null

If anyone has ever tried this, let me know.

Guest Article - CS-MARS Compliance Reporting

With compliance a hot topic for many organizations IT Security Management at the moment, i am pleased to provide this great document by Dale Tesch, CS-MARS PSS US/Canada AT Security.

This document maps various compliance regulations from SOX, PCI Data Security Standard and GLBA, and the reports that can help meet those objectives in CS-MARS.

CS-MARS 4.2.5 Released

The following changes and enhancements exist in 4.2.5:

•Support for Extended Daylight Savings Time. On March 11, 2007, the United States will adjust to Daylight Saving Time (DST) three weeks earlier than previous years and will end one week later on November 4, 2007. As per the Energy Policy Act of 2005, MARS supports this change in 4.2.4.

•Bug fixes. For the list of resolved issues, see the release notes.

New Vendor Signatures......

Part 3 of the Custom Parser Demo is now Available

As i mentioned earlier in the week, Part 3 of the Custom Parser demo is now available.


This is a more advanced version of the Custom Parser demo, which is a whopping 15 minutes long.

Now i must admit when i first saw the Custom Parser, and regular expression (PCRE which is perl-compatible regular expressions), i thought, i`d never beable to work this out, and it must be for seasoned developers. But to be honest when you have grasped the basics, it isnt that bad at all.


There are a couple of snippets in the cisco documentation for MARS, which i have separated below for easy reading....

Cisco MARS 4.2 - Configuring Custom Devices





Cisco MARS 4.2 - Regular Expression Reference




There are some tools to help you. (if you can name any other ones i`d be interested)

If i get stuck if i need to create a pattern, i try and use ReguLazy, pictured above.

ReguLazy - is a visual designer for Regular Expressions, and requires little to no knowledge of Regex Syntax for most common and simple parsing activities

This is a great little tool, but it hasnt been updated in a while.

I am also trying to get people to share their Custom Parsers in the User Group, if you are interested join up Cisco MARS User Group.

New Custom Parser Demo Now Available

Theres a new Cisco MARS Parser flash demo available on Demolabs.

Now to cut a long story short, i`ve decided to split the Parser template demo, into 2 parts.

Part 2, which is available now, is what i would term the BASIC level demo. This doesn`t go into too much detail on actually creating the Parser Patterns, but it useful for getting a basic understanding of what the Custom Parser functionality is for.

Part 3, which should hopefully be ready by the end of the week, is what i would call the ADVANCED demo. A Log Template is created from start to finish.

Custom Parser Demo 2

I`ve been very busy this week working in London, thus i havent had much time to do any articles.

I will let you know though, that the second Custom Parser demo, should be available next week on Demolabs.co.uk

Heres a sneek peak of MARS picking up P2P traffic, from a user behind a Sonicwall Device.