dionaea.cfg

;; dionaea
;; type: monitor
;; plugin_id: 1669
;;

[DEFAULT]
plugin_id=90013

[translation]
emulation=1
epmapper=2
ftpctrl=3
ftpd=4
ftpdata=5
ftpdataconnect=6
ftpdatalisten=7
httpd=8
mirrorc=9
mirrord=10
mssqld=11
mysqld=12
nc sink=13
pcap=14
remoteshell=15
RtpUdpStream=16
SipCall=17
SipSession=18
smbd=19
TftpClient=20
TftpServerHandler=21
xmppclient=22

[config]
enable=yes
type=detector
source=log
location=/var/log/ossim/dionaea.log
create_file=false
process=
start=no
stop=no
startup=
shutdown=

[DIONAEA - Connections]
event_type=event
regexp="connection\t(?P<id>\d+)\t(?P<type>\w+)\t(?P<proto>\w+)\t(?P<service>\w+)\t(?P<date>\d+)\.\d+\t(?P<sip>\d+.\d+.\d+.\d+)\t(?P<sport>\d+)\t(?P<dip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\t(?P<dport>\d+)\t(?P<param1>(.*))\t(?P<param2>(.*))"
date={normalize_date($date)}
plugin_sid={translate($service)}
src_ip={$sip}
src_port={$sport}
dst_ip={$dip}
dst_port={$dport}
userdata1={$id}
protocol={$proto}
userdata1={$type}
userdata2={$service}
userdata3={$param1}
userdata4={$param2}

[DIONAEA - downloads]
event_type=event
regexp="download\t(?P<id>\d+)\t(?P<url>.*)\t(?P<hash>\w+)\t(?P<sip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\t(?P<sport>\d+)\t(?P<dip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\t(?P<dport>\d+)\t(?P<date>\d+).\d+\t(?P<type>\w+)\t(?P<proto>\w+)\t(?P<service>\w+)\t(?P<sophos>(.*))"
date={normalize_date($date)}
plugin_sid=23
src_ip={$sip}
src_port={$sport}
dst_ip={$dip}
dst_port={$dport}
userdata1={$id}
protocol={$proto}
userdata1={$type}
userdata2={$service}
userdata3={$url}
userdata4={$hash}
userdata5={$sophos}