These MsgIDs are actually built into an RSA rule below are the syntax. We are trying to find out the description of the MsgID within the syntax
@Name('Module_esa000071_Alert')
@Description('Multiple Logs from MsgID Set with Same SourceIP and DestinationIP')
@RSAAlert(oneInSeconds=0, identifiers={"ip_src, ip_dst"})
SELECT * FROM
Event(
ip_src IS NOT NULL
AND
ip_dst IS NOT NULL
AND
msg_id IN ('00490' , '00490:08' , '00490:21' , '00004:16' , '00490:01' , '00490:07' , '00490:08' , '106001' , '106001:01' , '106002')
).std:groupwin(ip_src, ip_dst).win:time_length_batch(300 seconds, 10) GROUP BY ip_src, ip_dst HAVING COUNT(*) = 10;
Description: Multiple unique log events from group of message IDs (each log has to have a unique message ID among the specified set of IDs) with same source IP and destination IP that take place within given time window. Number of log events, list of message IDs to be monitored, whitelist of source and destination IPs and time window are configurable. The default number of log events is 3 and the time window is 300 seconds (5 minutes).
Version: 2
*/
module Module_esa000072;
@Name('Module_esa000072_Alert')
@RSAAlert(oneInSeconds=0, identifiers={"ip_src, ip_dst"})
SELECT * FROM
Event(
medium = 32
AND
ip_src IS NOT NULL
AND
ip_src NOT IN ('1.1.1.1' , '2.2.2.2')
AND
ip_dst IS NOT NULL
AND
ip_dst NOT IN ('1.1.1.1' , '2.2.2.2')
AND
msg_id IN ('00490' , '00490:06' , '00490:08' , '00490:21')
).std:groupwin(ip_src, ip_dst).win:time_length_batch(300 seconds, 3).std:unique(msg_id) GROUP BY ip_src, ip_dst HAVING COUNT(*) = 3;
