Skip to content

DDS: Watchguard-Firebox: Update Pipeline #21881

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+12 −13
Open

DDS: Watchguard-Firebox: Update Pipeline #21881

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1dac143
Update: grok regex update for firewall attack
manan-crest Nov 14, 2025
1519285
Update test results
manan-crest Nov 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 8 additions & 9 deletions watchguard_firebox/assets/logs/watchguard-firebox.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,26 +296,25 @@ pipeline:
enabled: true
source: message
samples:
- SYN flood attack against 10.10.10.10 from 10.10.10.10 detected.
500 SYN packets dropped since last alarm.
- UDP flood attack against 10.10.10.10 from 10.10.10.10 detected.
500 UDP flood packets dropped since last alarm. (udp_flood_dos)
- IPv4 source route attack from 10.10.10.10 detected.
- IP scan attack against 10.10.10.10 from 10.10.10.10 detected.
- "DDOS against server 10.10.10.10 detected. "
- DDOS against server 10.10.10.10 detected. (ddos_attack_dest_dos)
- DDOS from client 10.10.10.10 detected.
grok:
supportRules: ""
matchRules: >
matchRules: >-
parse_rule_30000152_to_30000159_30000162_to_30000166
%{regex(".*(?= attack)"):attack_type} attack (against
%{ip:network.destination.ip} )?from %{ip:network.client.ip}
detected.( %{integer:drop_packet_count} %{regex(".*(?=
packets)"):drop_packet_type} packets dropped since last alarm.)?
parse_rule_30000161 %{regex(".*(?= from)"):attack_type} from client %{ip:network.client.ip} detected.
packets)"):drop_packet_type} packets dropped since last alarm.)?(
(%{notSpace}))?
Comment on lines 309 to +313
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add whitespace before optional event code in grok rule

The newly added optional capture after the drop‑packet clause in matchRules does not consume the space that precedes event codes. The pattern is currently ...last alarm.)?((%{notSpace}))? so Grok expects a non‑space character immediately after the period. Messages of the form "… last alarm. (udp_flood_dos)" (as shown in the updated samples) therefore fail to match because the trailing space remains unmatched, and the whole rule fails. As a result, any attack alert that includes both drop counts and an event identifier will no longer be parsed. Insert an explicit space or \s* before the optional (%{notSpace}) so the rule accepts messages with a space before the code.

Useful? React with 👍 / 👎.

Copy link
Contributor Author

@manan-crest manan-crest Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have included the space in the actual parsing rule as ...last alarm.)?( (%{notSpace}))?, but when the pipeline is exported, the space does not appear in the .yaml file. However, the pipeline still handles the space correctly, as the test samples are being parsed properly.

parse_rule_30000161 %{regex(".*(?= from)"):attack_type} from client %{ip:network.client.ip} detected.( (%{notSpace}))?
parse_rule_30000160 %{regex(".*(?= against)"):attack_type} against server %{ip:network.destination.ip} detected.
parse_rule_30000160 %{regex(".*(?= against)"):attack_type} against server %{ip:network.destination.ip} detected.( (%{notSpace}))?
- type: pipeline
name: Processing of firewall alarm events
enabled: true
Expand Down
8 changes: 4 additions & 4 deletions watchguard_firebox/assets/logs/watchguard-firebox_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,8 +114,8 @@ tests:
tags:
- "source:LOGS_SOURCE"
timestamp: 1744104397000
-
sample: "<142>Apr 2 18:47:10 WatchGuard-Firebox TEST (2025-04-08T09:26:37) test: msg_id=\"3000-0160\" DDOS against server 10.0.1.34 detected."
-
sample: "<142>Apr 2 18:47:10 WatchGuard-Firebox TEST (2025-04-08T09:26:37) test: msg_id=\"3000-0160\" DDOS against server 10.10.10.10 detected. (ddos_attack_dest_dos)"
result:
custom:
attack_type: "DDOS"
Expand All @@ -125,12 +125,12 @@ tests:
network:
destination:
geoip: {}
ip: "10.0.1.34"
ip: "10.10.10.10"
syslog:
hostname: "WatchGuard-Firebox"
prival: 142
timestamp: 1744104397000
message: "DDOS against server 10.0.1.34 detected."
message: "DDOS against server 10.10.10.10 detected. (ddos_attack_dest_dos)"
service: "firewall"
tags:
- "source:LOGS_SOURCE"
Expand Down