Skip to content

OGO Shield WAF

Overview

OGO Shield Web Application Firewall provides protection and performance for your web applications and APIs.

This setup guide describes how to forward security events from OGO to Sekoia.io.

The following Sekoia.io built-in rules match the intake OGO WAF. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x OGO WAF on ATT&CK Navigator

Burp Suite Tool Detected

Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner)

  • Effort: intermediate
Download Files From Non-Legitimate TLDs

Detects file downloads from non-legitimate TLDs. Additional legitimates TLDs should be filtered according to the business habits.

  • Effort: master
Nimbo-C2 User Agent

Nimbo-C2 Uses an unusual User-Agent format in its implants.

  • Effort: intermediate
Potential Azure AD Phishing Page (Adversary-in-the-Middle)

Detects an HTTP request to an URL typical of the Azure AD authentication flow, but towards a domain that is not one the legitimate Microsoft domains used for Azure AD authentication.

  • Effort: intermediate
Potential Bazar Loader User-Agents

Detects potential Bazar loader communications through the user-agent

  • Effort: elementary
Potential DNS Tunnel

Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.

  • Effort: advanced
Potential Lemon Duck User-Agent

Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".

  • Effort: elementary
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary
Telegram Bot API Request

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

  • Effort: advanced

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Web application firewall logs OGO protects web applications and APIs

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind event
Category network
Type ["connection", "access"]

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/index.html\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"credibility\":\"100000\",\n        \"driveUid\": \"\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"false\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/index.html\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "action": "brain",
        "category": [
            "network"
        ],
        "dataset": "ogo-shield",
        "duration": 0,
        "kind": "event",
        "module": "ogo.shield.waf",
        "type": [
            "access",
            "connection"
        ]
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "location": {
                "lat": 48.844,
                "lon": 2.408
            }
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "observer": {
        "product": "Web Application Firewall",
        "type": "firewall",
        "vendor": "OGO Security"
    },
    "ogo": {
        "appliedAction": "brain",
        "auditMode": "false",
        "blocked": "false",
        "credibility": "100000",
        "geoblocked": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        },
        "site": "example.com",
        "whitelistedIp": "false"
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    },
    "source": {
        "address": "20.20.20.20",
        "ip": "20.20.20.20"
    },
    "url": {
        "full": "https://example.com/index.html"
    }
}
{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/%2F%2F/%2F%2F/%2F%2F/etc/passwd\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"credibility\":\"-1\",\n        \"driveUid\": \"4F1AB8245012413EBC182B80AAC1FFF3\",\n        \"driveLabel\":\"Linux files\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"true\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/%2F%2F/%2F%2F/%2F%2F/etc/passwd\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "action": "brain",
        "category": [
            "network"
        ],
        "dataset": "ogo-shield",
        "duration": 0,
        "kind": "event",
        "module": "ogo.shield.waf",
        "type": [
            "access",
            "connection"
        ]
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "location": {
                "lat": 48.844,
                "lon": 2.408
            }
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "observer": {
        "product": "Web Application Firewall",
        "type": "firewall",
        "vendor": "OGO Security"
    },
    "ogo": {
        "appliedAction": "brain",
        "auditMode": "false",
        "blocked": "true",
        "credibility": "-1",
        "drive": {
            "label": "Linux files",
            "uid": "4F1AB8245012413EBC182B80AAC1FFF3"
        },
        "geoblocked": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        },
        "site": "example.com",
        "whitelistedIp": "false"
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    },
    "rule": {
        "name": "Linux files",
        "uuid": "4F1AB8245012413EBC182B80AAC1FFF3"
    },
    "source": {
        "address": "20.20.20.20",
        "ip": "20.20.20.20"
    },
    "url": {
        "full": "https://example.com/%2F%2F/%2F%2F/%2F%2F/etc/passwd"
    }
}
{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/%2F%2F/%2F%2F/%2F%2F/etc/passwd\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"credibility\":\"19000\",\n        \"driveUid\": \"4F1AB8245012413EBC182B80AAC1FFF3\",\n        \"driveLabel\":\"Linux files\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"false\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/%2F%2F/%2F%2F/%2F%2F/etc/passwd\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "action": "brain",
        "category": [
            "network"
        ],
        "dataset": "ogo-shield",
        "duration": 0,
        "kind": "event",
        "module": "ogo.shield.waf",
        "type": [
            "access",
            "connection"
        ]
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "location": {
                "lat": 48.844,
                "lon": 2.408
            }
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "observer": {
        "product": "Web Application Firewall",
        "type": "firewall",
        "vendor": "OGO Security"
    },
    "ogo": {
        "appliedAction": "brain",
        "auditMode": "false",
        "blocked": "false",
        "credibility": "19000",
        "drive": {
            "label": "Linux files",
            "uid": "4F1AB8245012413EBC182B80AAC1FFF3"
        },
        "geoblocked": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        },
        "site": "example.com",
        "whitelistedIp": "false"
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    },
    "rule": {
        "name": "Linux files",
        "uuid": "4F1AB8245012413EBC182B80AAC1FFF3"
    },
    "source": {
        "address": "20.20.20.20",
        "ip": "20.20.20.20"
    },
    "url": {
        "full": "https://example.com/%2F%2F/%2F%2F/%2F%2F/etc/passwd"
    }
}
{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/\",\n    \"ogo\": {\n        \"appliedAction\": \"denied\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"true\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "action": "denied",
        "category": [
            "network"
        ],
        "dataset": "ogo-shield",
        "duration": 0,
        "kind": "event",
        "module": "ogo.shield.waf",
        "type": [
            "access",
            "connection"
        ]
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "location": {
                "lat": 48.844,
                "lon": 2.408
            }
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "observer": {
        "product": "Web Application Firewall",
        "type": "firewall",
        "vendor": "OGO Security"
    },
    "ogo": {
        "appliedAction": "denied",
        "auditMode": "false",
        "blocked": "true",
        "geoblocked": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        },
        "site": "example.com",
        "whitelistedIp": "false"
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    },
    "source": {
        "address": "20.20.20.20",
        "ip": "20.20.20.20"
    },
    "url": {
        "full": "https://example.com/"
    }
}
{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/index.html\",\n    \"ogo\": {\n        \"appliedAction\": \"bypass\",\n        \"driveUid\": \"\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"false\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/index.html\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "action": "bypass",
        "category": [
            "network"
        ],
        "dataset": "ogo-shield",
        "duration": 0,
        "kind": "event",
        "module": "ogo.shield.waf",
        "type": [
            "access",
            "connection"
        ]
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "location": {
                "lat": 48.844,
                "lon": 2.408
            }
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "observer": {
        "product": "Web Application Firewall",
        "type": "firewall",
        "vendor": "OGO Security"
    },
    "ogo": {
        "appliedAction": "bypass",
        "auditMode": "false",
        "blocked": "false",
        "geoblocked": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        },
        "site": "example.com",
        "whitelistedIp": "false"
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    },
    "source": {
        "address": "20.20.20.20",
        "ip": "20.20.20.20"
    },
    "url": {
        "full": "https://example.com/index.html"
    }
}
{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/index.html\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"driveUid\": \"\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"true\",\n        \"blocked\": \"true\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/index.html\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "action": "brain",
        "category": [
            "network"
        ],
        "dataset": "ogo-shield",
        "duration": 0,
        "kind": "event",
        "module": "ogo.shield.waf",
        "type": [
            "access",
            "connection"
        ]
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "location": {
                "lat": 48.844,
                "lon": 2.408
            }
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "observer": {
        "product": "Web Application Firewall",
        "type": "firewall",
        "vendor": "OGO Security"
    },
    "ogo": {
        "appliedAction": "brain",
        "auditMode": "false",
        "blocked": "true",
        "geoblocked": "true",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        },
        "site": "example.com",
        "whitelistedIp": "false"
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    },
    "source": {
        "address": "20.20.20.20",
        "ip": "20.20.20.20"
    },
    "url": {
        "full": "https://example.com/index.html"
    }
}
{
    "message": "{\n    \"geoIp\": {\n        \"countryCode\": \"FR\",\n        \"longitude\": \"2.408\",\n        \"latitude\": \"48.844\",\n        \"cityName\": \"Paris\"\n    },\n    \"responseTimeMs\": 0,\n    \"clusterId\": \"dd5a9ee4-fa4b-11ed-8505-8be10a9d80ae\",\n    \"responseCode\": 200,\n    \"site\": \"example.com\",\n    \"requestHeaders\": {\n        \"x-forwarded-proto\": \"http\",\n        \"x-ogo-shield\": \"0487b7d5\",\n        \"x-forwarded-port\": \"80\",\n        \"x-forwarded-for\": [\n            \"20.20.20.20\"\n        ],\n        \"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\",\n        \"x-real-ip\": \"20.20.20.20\",\n        \"x-forwarded-server\": \"677de812e565\",\n        \"x-forwarded-host\": \"example.com\",\n        \"host\": \"example.com\",\n        \"connection\": \"keep-alive\",\n        \"accept-encoding\": \"gzip, deflate, br\",\n        \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\"\n    },\n    \"responseHeaders\": {\n        \"content-encoding\": \"gzip\",\n         \"content-type\": \"text/html; charset=UTF-8\",\n         \"date\": \"Wed, 24 May 2023 13:58:44 GMT\",\n         \"server\": \"nginx/1.6.2 (Ubuntu)\"\n    },\n    \"@timestamp\": \"2023-05-24T14:00:10.866225015Z\",\n    \"requestUrl\": \"https://example.com/index.html\",\n    \"ogo\": {\n        \"appliedAction\": \"brain\",\n        \"credibility\":\"99782\",\n        \"driveUid\": \"41150EF72BD544529AA67E9B1C0310DC\",\n        \"driveLabel\":\"Smart Rate Limiting\",\n        \"whitelistedIp\": \"false\",\n        \"dryRun\": \"false\",\n        \"geoBlocked\": \"false\",\n        \"blocked\": \"false\"\n    },\n    \"clientIP\": \"20.20.20.20\",\n    \"@version\": \"1\",\n    \"requestInfo\": {\n        \"query-string\": \"\",\n        \"protocol\": \"HTTP/1.1\",\n        \"method\": \"GET\",\n        \"scheme\": \"http\",\n        \"request-uri\": \"/index.html\",\n        \"content-size\": \"0\"\n    },\n    \"responseContentSize\": 17,\n    \"timestamp\": 1684936810291\n}",
    "event": {
        "action": "brain",
        "category": [
            "network"
        ],
        "dataset": "ogo-shield",
        "duration": 0,
        "kind": "event",
        "module": "ogo.shield.waf",
        "type": [
            "access",
            "connection"
        ]
    },
    "@timestamp": "2023-05-24T14:00:10.291000Z",
    "client": {
        "address": "20.20.20.20",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "location": {
                "lat": 48.844,
                "lon": 2.408
            }
        }
    },
    "http": {
        "response": {
            "status_code": 200
        }
    },
    "observer": {
        "product": "Web Application Firewall",
        "type": "firewall",
        "vendor": "OGO Security"
    },
    "ogo": {
        "appliedAction": "brain",
        "auditMode": "false",
        "blocked": "false",
        "credibility": "99782",
        "drive": {
            "label": "Smart Rate Limiting",
            "uid": "41150EF72BD544529AA67E9B1C0310DC"
        },
        "geoblocked": "false",
        "request": {
            "headers": "{\"accept\": \"text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8\", \"accept-encoding\": \"gzip, deflate, br\", \"connection\": \"keep-alive\", \"host\": \"example.com\", \"user-agent\": \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36\", \"x-forwarded-for\": [\"20.20.20.20\"], \"x-forwarded-host\": \"example.com\", \"x-forwarded-port\": \"80\", \"x-forwarded-proto\": \"http\", \"x-forwarded-server\": \"677de812e565\", \"x-ogo-shield\": \"0487b7d5\", \"x-real-ip\": \"20.20.20.20\"}"
        },
        "response": {
            "headers": "{\"content-encoding\": \"gzip\", \"content-type\": \"text/html; charset=UTF-8\", \"date\": \"Wed, 24 May 2023 13:58:44 GMT\", \"server\": \"nginx/1.6.2 (Ubuntu)\"}"
        },
        "site": "example.com",
        "whitelistedIp": "false"
    },
    "related": {
        "ip": [
            "20.20.20.20"
        ]
    },
    "rule": {
        "name": "Smart Rate Limiting",
        "uuid": "41150EF72BD544529AA67E9B1C0310DC"
    },
    "source": {
        "address": "20.20.20.20",
        "ip": "20.20.20.20"
    },
    "url": {
        "full": "https://example.com/index.html"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
client.address keyword Client network address.
client.geo.city_name keyword City name.
client.geo.country_iso_code keyword Country ISO code.
client.geo.location geo_point Longitude and latitude.
destination.domain keyword The domain name of the destination.
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.dataset keyword Name of the dataset.
event.duration long Duration of the event in nanoseconds.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.module keyword Name of the module this data is coming from.
event.type keyword Event type. The third categorization field in the hierarchy.
http.request.body.bytes long Size in bytes of the request body.
http.request.method keyword HTTP request method.
http.request.referrer keyword Referrer for this HTTP request.
http.response.body.bytes long Size in bytes of the response body.
http.response.status_code long HTTP response status code.
observer.product keyword The product name of the observer.
observer.type keyword The type of the observer the data is coming from.
observer.vendor keyword Vendor name of the observer.
ogo.appliedAction keyword Brain (analyzed)
ogo.auditMode keyword Is site in audit mode
ogo.blocked keyword Is request blocked
ogo.credibility keyword Credibility rating of the request. Once dropped below the acceptability threshold of the cluster (or of the site if overloaded by Expert mode), the IP is temporarily banned.
ogo.drive.label keyword Brain drive label
ogo.drive.uid keyword Brain drive UID
ogo.geoblocked keyword Is request geoblocked
ogo.request.headers keyword All request headers
ogo.request.x_forwarded_for keyword X-Forwarded-For header
ogo.response.headers keyword All response headers
ogo.site keyword Normalized FQDN
ogo.whitelistedIp keyword Is IP whitelisted
rule.name keyword Rule name
rule.uuid keyword Rule UUID
server.address keyword Server network address.
server.ip ip IP address of the server.
source.ip ip IP address of the source.
tls.cipher keyword String indicating the cipher used during the current connection.
tls.version keyword Numeric part of the version parsed from the original string.
url.full wildcard Full unparsed URL.
url.path wildcard Path of the request, such as "/search".
url.query keyword Query string of the request.
user_agent.name keyword Name of the user agent.
user_agent.original keyword Unparsed user_agent string.

Configure

Create the intake in Sekoia.io

Go to the intake page and create a new intake from the format OGO WAF. Copy the intake key.

Configure log export

Set up the export type

In the OGO interface, go to My Profile > Log Export. Select Sekoia as the export type and paste the intake key in the form.

Activate export for sites

In the general configuration tab of desired sites, in the Owner section, activate the Log export.

Activate export for clusters

For OGO Shield Satellite owners, go to Admin Cluster > Maintenance and activate the Log export.

Further Readings