{"action":"created","issue":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/842","repository_url":"https://api.github.com/repos/ossec/ossec-hids","labels_url":"https://api.github.com/repos/ossec/ossec-hids/issues/842/labels{/name}","comments_url":"https://api.github.com/repos/ossec/ossec-hids/issues/842/comments","events_url":"https://api.github.com/repos/ossec/ossec-hids/issues/842/events","html_url":"https://github.com/ossec/ossec-hids/issues/842","id":155058302,"number":842,"title":"Custom ossec alarm output problems","user":{"login":"Canon88","id":19372121,"avatar_url":"https://avatars.githubusercontent.com/u/19372121?v=3","gravatar_id":"","url":"https://api.github.com/users/Canon88","html_url":"https://github.com/Canon88","followers_url":"https://api.github.com/users/Canon88/followers","following_url":"https://api.github.com/users/Canon88/following{/other_user}","gists_url":"https://api.github.com/users/Canon88/gists{/gist_id}","starred_url":"https://api.github.com/users/Canon88/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Canon88/subscriptions","organizations_url":"https://api.github.com/users/Canon88/orgs","repos_url":"https://api.github.com/users/Canon88/repos","events_url":"https://api.github.com/users/Canon88/events{/privacy}","received_events_url":"https://api.github.com/users/Canon88/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2016-05-16T15:47:38Z","updated_at":"2016-05-16T17:07:06Z","closed_at":null,"body":"OSSEC V2.8\r\nI have a question, we need help.\r\nWhy ossec after the custom alarm output port detection alarm can not be displayed before and after comparison.\r\nExample:\r\nThis is a default ossec alarm output:\r\n```\r\n** Alert 1462847255.46848: mail  - ossec,\r\n2016 May 09 19:27:35 (192.168.81.141) 192.168.81.141->netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort\r\nRule: 533 (level 7) -> 'Listened ports status (netstat) changed (new port opened or closed).'\r\nossec: output: 'netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort':\r\ntcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      \r\ntcp        0      0 ::1:631                     :::*                        LISTEN      \r\ntcp        0      0 :::22                       :::*                        LISTEN      \r\nPrevious output:\r\nossec: output: 'netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort':\r\ntcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      \r\ntcp        0      0 ::1:25                      :::*                        LISTEN      \r\ntcp        0      0 ::1:631                     :::*                        LISTEN      \r\ntcp        0      0 :::22                       :::*                        LISTEN   \r\n```\r\nThis is a custom alarm after alarm output ossec, you can see the difference with the default ossec alarm output.After you customize the alarm output for netstat alarms, change alarm port can not be displayed.\r\n\r\n`AV - Alert - \"1462844333\" --> RID: \"533\"; RL: \"7\"; RG: \"ossec,\"; RC: \"Listened ports status (netstat) changed (new port opened or closed).\"; USER: \"None\"; SRCIP: \"None\"; HOSTNAME: \"(Host-192-168-15-16) 192.168.15.16->netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort\"; LOCATION: \"(Host-192-168-15-16) 192.168.15.16->netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort\"; EVENT: \"[INIT]ossec: output: 'netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort':\\ntcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      \\ntcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      \\ntcp        0      0 ::1:631                     :::*                        LISTEN      \\ntcp        0      0 :::22                       :::*                        LISTEN      [END]\"; `\r\n\r\nHow do I solve this problem, thank you!"},"comment":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/comments/219482988","html_url":"https://github.com/ossec/ossec-hids/issues/842#issuecomment-219482988","issue_url":"https://api.github.com/repos/ossec/ossec-hids/issues/842","id":219482988,"user":{"login":"spookerlabs","id":11694775,"avatar_url":"https://avatars.githubusercontent.com/u/11694775?v=3","gravatar_id":"","url":"https://api.github.com/users/spookerlabs","html_url":"https://github.com/spookerlabs","followers_url":"https://api.github.com/users/spookerlabs/followers","following_url":"https://api.github.com/users/spookerlabs/following{/other_user}","gists_url":"https://api.github.com/users/spookerlabs/gists{/gist_id}","starred_url":"https://api.github.com/users/spookerlabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spookerlabs/subscriptions","organizations_url":"https://api.github.com/users/spookerlabs/orgs","repos_url":"https://api.github.com/users/spookerlabs/repos","events_url":"https://api.github.com/users/spookerlabs/events{/privacy}","received_events_url":"https://api.github.com/users/spookerlabs/received_events","type":"User","site_admin":false},"created_at":"2016-05-16T17:07:06Z","updated_at":"2016-05-16T17:07:06Z","body":"But just to clarify\r\n\r\nalerts.log default\r\n\r\n** Alert 1463417219.5767829: mail  - ossec,\r\n2016 May 16 16:46:59 OctopusLiveDemo->netstat -tan |grep LISTEN |egrep -v '(127.0.0.1| \\\\1)' | sort\r\nRule: 533 (level 7) -> 'Listened ports status (netstat) changed (new port opened or closed).'\r\nossec: output: 'netstat -tan |grep LISTEN |egrep -v '(127.0.0.1| \\\\1)' | sort':\r\ntcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN\r\ntcp        0      0 0.0.0.0:9977            0.0.0.0:*               LISTEN\r\ntcp6       0      0 :::22                   :::*                    LISTEN\r\ntcp6       0      0 :::80                   :::*                    LISTEN\r\ntcp6       0      0 :::9977                 :::*                    LISTEN\r\nPrevious output:\r\nossec: output: 'netstat -tan |grep LISTEN |egrep -v '(127.0.0.1| \\\\1)' | sort':\r\ntcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN\r\ntcp6       0      0 :::22                   :::*                    LISTEN\r\ntcp6       0      0 :::80                   :::*                    LISTEN\r\n\r\nalerts.json\r\n\r\n{\"rule\":{\"level\":7,\"comment\":\"Listened ports status (netstat) changed (new port opened or closed).\",\"sidid\":533},\"location\":\"netstat -tan |grep LISTEN |egrep -v '(127.0.0.1| \\\\\\\\1)' | sort\",\"full_log\":\"ossec: output: 'netstat -tan |grep LISTEN |egrep -v '(127.0.0.1| \\\\\\\\1)' | sort':\\ntcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     \\ntcp        0      0 0.0.0.0:9977            0.0.0.0:*               LISTEN     \\ntcp6       0      0 :::22                   :::*                    LISTEN     \\ntcp6       0      0 :::80                   :::*                    LISTEN     \\ntcp6       0      0 :::9977                 :::*                    LISTEN     \"}\r\n\r\nI think something is missing at json output, maybe OSSIM use json output format but as Dan mentioned better to ask at OSSIM community."}}