Parse custom variables
Parse custom variables

If there were any custom variables in the OSSEC policy, they were not being parsed; the variable names were simply printed as-is.

e.g. in 50_syslog_rules.xml, there is a variable:

<var name="BAD_WORDS">core_dumped|failure|error|attack|bad |illegal |denied|refused|unauthorized|fatal|failed|Segmentation Fault|Corrupted</var>

and rule 1002 used this:

<rule id="1002" level="2">
  <match>$BAD_WORDS</match>
  <options>alert_by_email</options>
  <description>Unknown problem somewhere in the system.</description>
</rule>

but it was just being converted to the json as is:

{
  "name": "Unknown problem somewhere in the system. (1002)",
  "search_pattern": "$BAD_WORDS",
  ...
}

andrewsmhay/ossec2halo