Today, I'd like to promote a tool that I wrote four years ago and that is running every 30 minutes on my OSSEC server. DShield offers many clients to collect and process logs from multiple firewall brands/vendors. But today, more and more logs are already centralized to a SIEM. Collecting the events twice can be a pain for performance, complexity and security reasons. I'm collecting firewall logs from many devices with OSSEC so there are stored in a central place. The idea of ossec2dshield is to read the logs from OSSEC and forward them to DShield. Writing a DShield agent is easy, everything is described here. Basically, the script parses the OSSEC's firewall.log and generates the corresponding DShield events. 

The script syntax is self-explanatory:

$ ossec2dshield.pl --log=file --userid=dshieldid --statefile=file --from=email --mta=hostname
                  [--help] [--debug] [--test] [--obfuscate] [--ports=port1,port2,...]  
Where: 
--help                   : This help
--debug                  : Display processing details to stdout
--test                   : Test only, do not mail the info to dshield.org
--obfuscate              : Obfuscate the destination address (10.x.x.x)
--ports=port1,!port2,... : Filter destination ports ex: !25,!80,445,53 
--log=file               : Your OSSEC firewall.log
--userid=dshieldid       : Your dshield.org UserID (see http://www.dshield.org)
--statefile=file         : File to write the state of log processing
--from=email             : Your e-mail address (From:)
--mta=hostname           : Your Mail Transfer Agent (to send mail to dshield.org)

You will need your dshield.org UserID, a mail relay (MTA). The state file is very important: it contains the timestamp of the last processed event. This prevents events to be sent twice to dshield.org. Once processed, the data will be submitted to register(at)dshield(dot)org. Using “–-port“, you can exclude or restrict to some interesting ports. Example: “–-port=’!80,!22,!443′” will report all blocked firewall traffic except for the destination ports 80, 22 and 443. The current version of the script is not so powerful as the regular Dshield clients but it works very well. Ideas and suggestions are always welcome. The script is available in my github.com repository. Happy logging!

Xavier Mertens
ISC Handler - Freelance Security Consultant
rootshell.be
truesec.be