#####
#
# Copyright (C) 2003 Exaprobe
# All Rights Reserved
# This ruleset is currently unmaintained.  Contact the Prelude
# development team if you would like to maintain it.
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING.  If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
#
#####

#######################################################################
###                           Changelog                             ###
#######################################################################
#######################################################################
#								      #
# 2003-03-03	Vincent Glaume	<vglaume@exaprobe.com>		      #
#	+ add rules 1 to 6.2 					      #
###								      #
###								      #
# 2003-04-09	Thierry Briche	<tbriche@exaprobe.com>		      #
#	+ add rules 7 to 9					      #
###								      #		
###        							      #
# 2003-04-15	Theirry Biche	<tbriche@exaprobe.com>		      #
#	+ add rules                				      #
#	+ change rules 4 8 					      #
#######################################################################

###
# I. FireWall-1, VPN-1
###

# 1. Dropped packets; several cases depending on the service format.
# 1.a Both ports are numbers
# No sample log entry; please submit

regex=drop   ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: (\d+). proto: (\w+). rule: (\d+); \
 classification.text=Packet dropped and logged; \
 id=100; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged a $9 packet sent by $5:$6 to $7:$8 (rule #$10); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 source(0).service.port=$6; \
 source(0).service.protocol=$9; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$7; \
 target(0).service.port=$8; \
 target(0).service.protocol=$9; \
 last

# 1.b Source or Target port is a service name
# No sample log entry; please submit
regex=drop   ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=Packet dropped and logged; \
 id=101; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged a $9 packet sent by $5:$6 to $7:$8 (rule #$10); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 source(0).service.port=$6; \
 source(0).service.protocol=$9; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$7; \
 target(0).service.name=$8; \
 target(0).service.protocol=$9; \
 last

# No sample log entry; please submit
regex=drop   ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: (\d+). proto: (\w+). rule: (\d+); \
 classification.text=Packet dropped and logged; \
 id=102; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged a $9 packet sent by $5:$6 to $7:$8 (rule #$10); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 source(0).service.name=$6; \
 source(0).service.protocol=$9; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$7; \
 target(0).service.port=$8; \
 target(0).service.protocol=$9; \
 last

# 1.c Both ports are service names
# No sample log entry; please submit
regex=drop   ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=Packet dropped and logged; \
 id=103; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged a $9 packet sent by $5:$6 to $7:$8 (rule #$10); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 source(0).service.name=$6; \
 source(0).service.protocol=$9; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$7; \
 target(0).service.name=$8; \
 target(0).service.protocol=$9; \
 last


# 2. Accepted packets; same as above...
# 2.a Both ports are numbers
# No sample log entry; please submit
regex=accept ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: (\d+). proto: (\w+). rule: (\d+); \
 classification.text=Packet accepted and logged; \
 id=104; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 accepted and logged a $9 packet sent by $5:$6 to $7:$8 (rule #$10); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 source(0).service.port=$6; \
 source(0).service.protocol=$5; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$7; \
 target(0).service.port=$8; \
 target(0).service.protocol=$5; \
 last

# 2.b One port is a service name
# No sample log entry; please submit
regex=accept ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=Packet accepted and logged; \
 id=105; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 accepted and logged a $9 packet sent by $5:$6 to $7:$8 (rule #$10); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 source(0).service.port=$6; \
 source(0).service.protocol=$5; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$7; \
 target(0).service.name=$8; \
 target(0).service.protocol=$5; \
 last

# No sample log entry; please submit
regex=accept ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: (\d+). proto: (\w+). rule: (\d+); \
 classification.text=Packet accepted and logged; \
 id=106; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 accepted and logged a $9 packet sent by $5:$6 to $7:$8 (rule #$10); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 source(0).service.name=$6; \
 source(0).service.protocol=$5; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$7; \
 target(0).service.port=$8; \
 target(0).service.protocol=$5; \
 last

# 2.c Only service names
# No sample log entry; please submit
regex=accept ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=Packet accepted and logged; \
 id=107; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 accepted and logged a $9 packet sent by $5:$6 to $7:$8 (rule #$10); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 source(0).service.name=$6; \
 source(0).service.protocol=$5; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$7; \
 target(0).service.name=$8; \
 target(0).service.protocol=$5; \
 last


# 3 ICMP packets
# 3.1 Dropped packets
# No sample log entry; please submit
regex=drop   ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). dst: ([\d\.]+). proto: icmp. icmp-type: (\d+). icmp-code: (\d+). rule: (\d+); \
 classification.text=Packet dropped and logged; \
 id=108; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=failed; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=FireWall $1 dropped and logged an icmp packet sent by $5 to $6, with type $7 and code $8 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 last

# 3.2 Accepted packets
# No sample log entry; please submit
regex=accept ([\d+\.]+) (<|>)([\w-]+) (\w+) product: VPN-1 & FireWall-1. src: ([\d\.]+). dst: ([\d\.]+). proto: icmp. icmp-type: (\d+). icmp-code: (\d+). rule: (\d+); \
 classification.text=Packet accepted and logged; \
 id=109; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.severity=medium; \
 assessment.impact.description=FireWall $1 dropped and logged an icmp packet sent by $5 to $6, with type $7 and code $8 (rule #$9); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$5; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$6; \
 last


# 4. Misc. other Packets, we won't try to be as exhaustive as above
# No sample log entry; please submit
regex=product: VPN-1 & FireWall-1. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: ([\w-]+). proto: (\w+). rule: (\d+); \
 classification.text=Packet logged; \
 id=110; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.completion = failed; \
 assessment.impact.type = other; \
 assessment.impact.severity = low; \
 assessment.impact.description=FireWall-1 has logged a $5 packet sent by $1:$2 to $3:$4 (rule #$6); \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$1; \
 source(0).service.protocol=$5; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$3; \
 target(0).service.protocol=$5; \
 last


# 5. Generic VPN-1 / FW-1 alert
# No sample log entry; please submit
regex=product: VPN-1 & FireWall-1; \
 classification.text=Generic alert; \
 id=111; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=VPN-1 & FireWall-1 generic alert; \
 last



###
# II. SmartDefense
###

# 1. Port scanning
# No sample log entry; please submit
regex=product: SmartDefense. dst: ([\d\.]+). attack: Port Scanning. src: ([\d\.]+); \
 classification.text=Port scan detection; \
 id=112; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.severity=low; \
 assessment.impact.type=recon; \
 assessment.impact.description=Checkpoint SmartDefense has detected a port scan from $2 to $1; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$1; \
 last


# 2. Successive alerts
# No sample log entry; please submit
regex=product: SmartDefense. attack: Successive Alerts; \
 classification.text=Successive alerts; \
 id=113; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.severity=low; \
 assessment.impact.type=other; \
 assessment.impact.description=Checkpoint Smart Defense: Successive alerts; \
 last


# 3. Successive multiple connections
# No sample log entry; please submit
regex=product: SmartDefense. service: ([\w-]+|\d+). attack: Successive Multiple Connections. dst: ([\d\.]+). src: ([\d\.]+); \
 classification.text=Successive multiple connections; \
 id=114; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=Checkpoint Smart Defense: multiple connections from $3 to $2:$1; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$2; \
 target(0).service.name=$1; \
 last

# 4. Bad packet
# 4.1 Port number to port number
# No sample log entry; please submit
regex=product: SmartDefense. Attack Info: (.+). attack: Bad packet. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: (\d). proto: ([\w-]+|\d+); \
 classification.text=Bad $6 flags; \
 id=115; \
 revision=1; \ 
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description= $1 sent by $2:$3 to $4:$5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.port=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.port=$5; \
 last

#4.2 port number to Service Name
# No sample log entry; please submit
regex=product: SmartDefense. Attack Info: (.+). attack: Bad packet. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: ([\w-]+). proto: ([\w-]+|\d+); \
 classification.text=Bad $6 flags; \
 id=116; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description= $1 sent by $2:$3 to $4:$5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.port=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.name=$5; \
 last

#4.3 Service Name to service name
# No sample log entry; please submit
regex=product: SmartDefense. Attack Info: (.+). attack: Bad packet. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: ([\w-]+). proto: ([\w-]+|\d+); \
 classification.text=Bad $6 flags; \
 id=117; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description= $1 sent by $2:$3 to $4:$5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.name=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.name=$5; \
 last

#4.4 Service Name to port number
# No sample log entry; please submit
regex=product: SmartDefense. Attack Info: (.+). attack: Bad packet. src: ([\d\.]+). s_port: ([\w-]+). dst: ([\d\.]+). service: (\d+). proto: ([\w-]+|\d+); \
 classification.text=Bad $6 flags; \
 id=118; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description= $1 sent by $2:$3 to $4:$5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.name=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.port=$5; \
 last

# 5. Large ping
# No sample log entry; please submit
regex=product: SmartDefense. Attack Info: Echo request too long. attack: Large ping. src: ([\d\.]+). dst: ([\d\.]+); \
 classification.text=Large ping; \
 id=119; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=Large ping sent by $1 to $2; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$1; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$2; \
 last

# 6. Small MSS
# 6.1 Port number
# No sample log entry; please submit
regex=product: SmartDefense. Attack Info: MSS (\d+) is too small. attack: Small PMTU. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: (\d+). proto: ([\w-]+|\d+); \
 classification.text=Small PMTU; \
 id=120; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=A $6 packet with too small MSS ($1) was sent to $4:$5 by $2:$3; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.port=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.port=$5; \
 last

# 6.2 Service name
# No sample log entry; please submit
regex=product: SmartDefense. Attack Info: MSS (\d+) is too small. attack: Small PMTU. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: ([\w-]+). proto: ([\w-]+|\d+); \
 classification.text=Small PMTU; \
 id=121; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=A $6 packet with too small MSS ($1) was sent to $4:$5 by $2:$3; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 source(0).service.port=$3; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 target(0).service.name=$5; \
 last

# 7. Bad proto sequence
# 7.1 Port number 
# No sample log entry; please submit
regex=product: SmartDefense. TCP sequence validator: (.+). attack: Bad TCP sequence. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: (\d+). proto: ([\w-]+|\d+); \
 classification.text=Bad $6 sequence; \
 id=122; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=Dropped packet send by $2 to $4 with $1; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 source(0).service.port=$3; \
 target(0).service.port=$5; \
 last

# 7.2 Service name
# No sample log entry; please submit
regex=product: SmartDefense. TCP sequence validator: (.+). attack: Bad TCP sequence. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: ([\w-]+). proto: ([\w-]+|\d+); \
 classification.text=Bad $6 sequence; \
 id=123; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=Dropped packet send by $2 to $4 with $1; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 source(0).service.port=$3; \
 target(0).service.name=$5; \
 last

# 8. Packet rejected : URL worm
# 8.1 Port number
# No sample log entry; please submit
regex=product: SmartDefense. URL filter pattern detected: (.+). attack: URL worm. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: (\d+). proto: ([\w-]+|\d+); \
 classification.text=URL worm; \
 id=124; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=Rejected packet send by $2 to $4 with $1; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 source(0).service.port=$3; \
 target(0).service.port=$5; \
 last

# 8.2 Service number
# No sample log entry; please submit
regex=product: SmartDefense. URL filter pattern detected: (.+). attack: URL worm. src: ([\d\.]+). s_port: (\d+). dst: ([\d\.]+). service: ([\w-]+). proto: ([\w-]+|\d+); \
 classification.text=URL worm; \
 id=125; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=Rejected packet send by $2 to $4 with $1; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 target(0).node.address(0).category = ipv4-addr; \
 target(0).node.address(0).address=$4; \
 source(0).service.port=$3; \
 target(0).service.name=$5; \
 last

# 9. Generic Smart Defense alert
# No sample log entry; please submit
regex=product: SmartDefense; \
 classification.text=Misc logs; \
 id=126; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=Checkpoint Smart Defense: generic alert; \
 last

###
# III. System Monitor
###
# No sample log entry; please submit
regex=([\d+\.]+) (<|>)\s+(\w+) System Alert message: (.+). Object: (\w+). (.+). product: System Monitor; \
 classification.text=Checkpoint System Monitor; \
 id=127; \
 revision=1; \
 analyzer(0).name=FW-1; \
 analyzer(0).manufacturer=Checkpoint; \
 analyzer(0).class=Firewall; \
 assessment.impact.type=other; \
 assessment.impact.severity=low; \
 assessment.impact.description=System alert reported a $4; \
 last