Sagan Yaml config variables that are similar

[bryant-smith]

I was recently working on the below rule and had some issues getting it to work properly. Everything worked except the MONITORED_RDP_HOSTS2. I thought a non-ascii character had gotten into the yaml file when copying and pasting but couldn't find one. I moved the variable and values in the yaml file to the top, above the MONITORED_RDP_HOSTS and it suddenly worked. After playing with it a bit I realized it the the names of the variables in the yaml file. I put the MONITORED_RDP_HOSTS2 below the other one again and renamed it to MONITORED_RDP_HOSTS1. With this changed it worked again. It seems that sagan will look for the variable and if it finds something "similar" it will use that one.

If a test log and yaml file is need let me know and I'll send them over.

Rule:
alert any any any -> any any (msg: "[WINDOWS-SECURITY] RDP Connection to Monitored SOX Server from Unauthorized Source"; meta_content: "%sagan%|3a|", 4624,4625,528; meta_content: "Logon Type|3a| %sagan%",7,10; meta_content: "Account Name|3a| %sagan%", $MONITORED_RDP_HOSTS2; meta_nocase; meta_content:! "Source Network Address|3a| %sagan%", $AUTHORIZED_RDP_SOURCES; program:*Security*; parse_src_ip: 1; default_proto: tcp; classtype: suspicious-login; sid:123; rev:2;)

Yaml:

...
MONITORED_RDP_HOSTS: "bob1,bob2"

MONITORED_RDP_HOSTS2: "jill1,jill2"
...

[quadrantsec]

This is related to issue #27 .