prelude-lml 1.0.0-5.3ubuntu2 / etc / prelude-lml / ruleset / ntsyslog.rules

#####
#
# Copyright (C) 2003 Vincent Glaume
# Currently supported by G Ramon Gomez <gene at gomezbrothers dot com>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; see the file COPYING.  If not, write to
# the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
#
#####

#############################################################################
#
# This ruleset aims at analyzing the logs returned by the ntsyslog
# application, which converts NT events to syslog.
# English logs only.
# TODO:
# *  Add all log entries not currently present
#
#############################################################################


###
# I. Security events
###

# 1. Success events
# 1.a 515
#LOG:Jul 11 09:33:18 somehost.ragingwire.net smf-eng-srobins/smf-eng-srobins security[success] 515 NT AUTHORITY\SYSTEM  A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests.     Logon Process Name:KSecDD
regex=security\[success\] 515 (.*)  A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests.     Logon Process Name:([\w\\]+); \
 classification.text=Authentication system started; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=515; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com183.html; \
 id=1400; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=$2 has registered as a trusted logon process; \
 source(0).process.name=$2; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 last

# 1.b 528
#LOG:Jul 11 13:44:11 somehost.ragingwire.net smf-eng-srobins/smf-eng-srobins security[success] 528 SACRAMENTO\ggomez  Successful Logon:  User Name:ggomez  Domain:SACRAMENTO  Logon ID:(0x0,0x16AC1854)  Logon Type:7  Logon Process:User32    Authentication Package:Negotiate  Workstation Name:SMF-ENG-GGOMEZ  Logon GUID: {621924db-649e-3b17-b41a-215e55680eb3}
regex=security\[success\] 528 (.*) Successful Logon:  User Name:([\w ]+)  Domain:(.+)  Logon ID:\(.*\)  Logon Type:(\d+)  Logon Process:(\w+) .* Workstation Name:(\S+); \
 classification.text=Login; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=528; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com189.html; \
 id=1401; \
 revision=3; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=$2 successfully logged on on $6 ($3 domain) via $5; \
 source(0).process.name=$5; \
 source(0).node.address(0).category=unknown; \
 source(0).node.address(0).address=$6; \
 source(0).node.name=$6; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$2; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Logon type; \
 additional_data(0).data=$4; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Authentication domain; \
 additional_data(1).data=$3; \
 last

# 1.c 538
#LOG:Jun 24 15:22:39 bigipnet security[success] 538 NT AUTHORITY\ANONYMOUS LOGON User Logoff: User Name:ANONYMOUS LOGON Domain:NT AUTHORITY Logon ID:(0x0,0x938205) Logon Type:3
regex=security\[success\] 538 .* User Logoff:\s+User Name:([\w ]+) Domain:([\w ]+) Logon ID:\S+ Logon Type:(\d+); \
 classification.text=Logoff; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=538; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com199.html; \
 id=1402; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=$1 logged off; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Logon type; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Authentication domain; \
 additional_data(1).data=$2; \
 last

# 1.d 560
# Currently broken on Windows 2003; verify against older Windows
#LOG:Jul 11 08:55:16 somehost.ragingwire.net smf-eng-srobins/smf-eng-srobins security[success] 560 NT AUTHORITY\SYSTEM  Object Open:  Object Server:Security Account Manager  Object Type:SAM_DOMAIN  Object Name:SMF-ENG-GGOMEZ  Handle ID:1290248  Operation ID:{0,378510053}  Process ID:944  Image File Name: C:\WINDOWS\system32\lsass.exe  Primary User Name:SMF-ENG-GGOMEZ$  Primary Domain:RES  Primary Logon ID:(0x0,0x3E7)  Client User Name:SMF-ENG-GGOMEZ$  Client Domain:RES  Client Logon ID:(0x0,0x3E7)  Accesses: %%1537 %%1538 %%1539 %%1540 %%5392 %%5393 %%5394 %%5395 %%5396 %%5398 %%5399 %%5400 %%5401 %%5402   Privileges:-  Restricted Sid Count: 0
regex=security\[success\] 560 (.*) Object Open:\s* Object Server:[\w\s]+ Object Type:[\w\_]+\s* Object Name:([\w-]+)\s* Handle ID:\d+\s* Operation ID:.*\s* Process ID:(\d+) [\S ]+ Primary User Name:(\S*)\s* Primary Domain:\S+\s* Primary Logon ID:\S*\s* Client User Name:(\S+)\s* Client Domain; \
 classification.text=Object opened; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=560; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com202.html; \
 id=1403; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=$3 opened an object $2; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$4; \
 source(0).user.user_id(2).type=current-user; \
 source(0).user.user_id(2).name=$5; \
 source(0).process.pid=$3; \
 last

# 1.e 562
#LOG:Jul 11 08:55:16 somehost.ragingwire.net smf-eng-srobins/smf-eng-srobins security[success] 562 NT AUTHORITY\SYSTEM  Handle Closed:  Object Server:Security Account Manager  Handle ID:1093856  Process ID:944  Image File Name: C:\WINDOWS\system32\lsass.exe
regex=security\[success\] 562 (.*) Handle Closed:  Object Server:[\w\s]+  Handle ID:(\d+)  Process ID:(\d+)  Image File Name: (.+); \
 classification.text=Object closed; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=562; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com204.html; \
 id=1404; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Object Handle $2 closed; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 target(0).process.pid=$3; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Handle ID; \
 additional_data(0).data=$2; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Image; \
 additional_data(1).data=$4; \
 last

# 1.g 577
#LOG:Jul 11 15:09:21 somehost.ragingwire.net smf-eng-srobins/smf-eng-srobins security[success] 577 NT AUTHORITY\SYSTEM  Privileged Service Called:  Server: NT Local Security Authority / Authentication Service  Service:LsaRegisterLogonProcess()  Primary User Name:SMF-ENG-GGOMEZ$  Primary Domain:RES  Primary Logon ID:(0x0,0x3E7)  Client User Name:SMF-ENG-GGOMEZ$  Client Domain:RES  Client Logon ID:(0x0,0x3E7)  Privileges:SeTcbPrivilege
regex= security\[success\] 577 (.*)  Privileged Service Called:  Server:.+  Service:(.*)  Primary User Name:(.+)  Primary Domain:.+  Primary Logon ID:\(.*\)  Client User Name:(.+)  Client Domain:.+  Client Logon ID:.+  Privileges:(.+); \
 classification.text=User privilege exercised; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=577; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com213.html; \
 id=1406; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Service $2 called with the following privileges: $5; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$3; \
 source(0).user.user_id(2).type=current-user; \
 source(0).user.user_id(2).name=$4; \
 target(0).node.address(0).category=unknown; \
 target(0).node.address(0).address=$2; \
 target(0).node.name=$2; \
 last

# 1.h
# No log sample; please submit
regex= security\[success\] 643 (.*)  Domain Policy Changed: Password Policy  modified  Domain:(.+)  Domain ID: .+  Caller User Name:(.+); \
 classification.text=Password policy modified; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=643; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com263.html; \
 id=1407; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=User $3 modified the password policy for the $2 domain; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$3; \
 last

# 1.i 680
#LOG:Oct 22 20:57:03 smf-syslog-02 smf-dc-01/smf-dc-01 security[success] Account Used for Logon by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  Account Name:  DRankin  Workstation:   SMF-HLP-16
regex= security\[success\].*Account Used for Logon by: (.+)  Account Name: (.+)  Workstation: (.+); \
 classification.text=Login; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=680; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com304.html; \
 id=1408; \
 revision=3; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=Logon attempt on $3 using the $2 account; \
 source(0).node.address(0).category=unknown; \
 source(0).node.address(0).address=$3; \
 source(0).node.name=$3; \
 source(0).process.name=$1; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$2; \
 last

# 1.j 682
# No log sample; please submit
regex= security\[success\] 682 (.*)  Session reconnected to winstation:  User Name:([\w ]+)  Domain:.+  Logon ID:\(.+\)  Session Name:.+  Client Name:(.+)  Client Address:([\d\.]+); \
 classification.text=Remote control user reconnected; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=682; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com306.html; \
 id=1409; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Session reconnection from $5; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).node.address(1).category=unknown; \
 source(0).node.address(1).address=$3; \
 source(0).node.name=$3; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$2; \
 last

# 1.k 683
# No log sample; please submit
regex= security\[success\] 683 (.*)  Session disconnected from winstation:  User Name:([\w ]+)  Domain:.+  Logon ID:\(.+\)  Session Name:.+  Client Name:(.+)  Client Address:([\d\.]+); \
 classification.text=Remote control user disconnected; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=683; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com307.html; \
 id=1410; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Session reconnection from $4; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$4; \
 source(0).node.address(1).category=unknown; \
 source(0).node.address(1).address=$3; \
 source(0).node.name=$3; \
 source(0).user.user_id(0).type=target-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$2; \
 last

# 1.l other
# No log sample; please submit
#regex= security\[success\] (\d+); \
# classification.text=Windows Event ID [$1]; \
# id=1411; \
# revision=1; \
# analyzer(0).name=NTsyslog; \
# analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
# analyzer(0).class=Logging; \
# assessment.impact.severity=low; \
# assessment.impact.type=other; \
# assessment.impact.description=Security Success message with identifier #$1; \
# last


# 2. Failure events
# 2.a 529 or 534
#LOG:Dec 10 00:23:37 webbrain.itg.sac.tfs security[failure] 529 NT AUTHORITY\SYSTEM  Logon Failure:  Reason:Unknown user name or bad password  User Name:administrator  Domain:ITG  Logon Type:2  Logon Process:Advapi    Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  Workstation Name:WEBBRAIN
regex=security\[failure\] (529|534) .+ Logon Failure:  Reason:(.+)  User Name:([\w ]+)  Domain:(.+)  Logon Type:(\d+)  Logon Process:(\w+)    Authentication Package:.+  Workstation Name:(.+); \
 classification.text=Login; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=$1; \
 id=1412; \
 revision=3; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=medium; \
 assessment.impact.completion=failed; \
 assessment.impact.type=user; \
 assessment.impact.description=Logon as $3 failed: $2; \
 source(0).process.name=$6; \
 target(0).node.address(0).category=unknown; \
 target(0).node.address(0).address=$7; \
 target(0).node.name=$7; \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$3; \
 additional_data(0).type=integer; \
 additional_data(0).meaning=Logon type; \
 additional_data(0).data=$5; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Authentication domain; \
 additional_data(1).data=$4; \
 last

# 2.b 578
#LOG:Dec  9 17:42:49 testdb.itg.sac.tfs security[failure] 578 ITG\mzirion  Privileged object operation:  Object Server:Security  Object Handle:4294967295  Process ID:3540  Primary User Name:TESTDB$  Primary Domain:ITG  Primary Logon ID:(0x0,0x3E7)  Client User Name:mzirion  Client Domain:ITG  Client Logon ID:(0x2,0x5E829351)  Privileges:SeIncreaseBasePriorityPrivilege
regex=security\[failure\] 578 .+ Privileged object operation:  Object Server:Security  Object Handle:\d+  Process ID:(\d+)  Primary User Name:(.+)  Primary Domain:(.+)  Primary Logon ID:\(.*\)  Client User Name:([\w ]+)  Client.+Privileges:(\S+); \
 classification.text=User privilege exercised; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=578; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com214.html; \
 id=1413; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=medium; \
 assessment.impact.type=user; \
 target(0).process.pid=$1; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$2; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$4; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Authentication domain; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Privileges; \
 additional_data(1).data=$5; \
 last

# 2.c 627
# LOG:Dec  7 20:07:49 testdb.itg.sac.tfs security[failure] 627 NT AUTHORITY\SYSTEM  Change Password Attempt:  Target Account Name:TsInternetUser  Target Domain:TESTDB  Target Account ID: %{S-1-5-21-854245398-413027322-725345543-1000}  Caller User Name:TESTDB$  Caller Domain:ITG  Caller Logon ID:(0x0,0x3E7)  Privileges:-
regex= security\[failure\] 627 (.+)  Change Password Attempt:  Target Account Name:(.+)  Target Domain:(.+)  Target Account ID:.+  Caller User Name:(.+); \
 classification.text=Password change; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=627; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com247.html; \
 id=1414; \
 revision=2; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=medium; \
 assessment.impact.type=user; \
 assessment.impact.description=$4 attempted to change the password for $2 on the $3 domain; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).user.user_id(1).type=current-user; \
 source(0).user.user_id(1).name=$4; \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$2; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Authentication domain; \
 additional_data(0).data=$3; \
 last

# 2.d 681
# LOG:Dec 10 08:20:07 mrfreeze.itg.sac.tfs security[failure] 681 NT AUTHORITY\SYSTEM  The logon to account: tfslegalask@itg.sac.tfs  by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  from workstation: MRFREEZE  failed. The error code was: 3221225572
regex=security\[failure\] 681 (.+)  The logon to account: (\S+)  by:.+  from workstation: (\w+); \
 classification.text=Login; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=Windows Event ID; \
 classification.reference(0).name=681; \
 classification.reference(0).url=http://www.ultimatewindowssecurity.com/events/com326.html; \
 id=1415; \
 revision=3; \
 analyzer(0).name=NTsyslog; \
 analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
 analyzer(0).class=Logging; \
 assessment.impact.severity=medium; \
 assessment.impact.completion=failed; \
 assessment.impact.type=user; \
 assessment.impact.description=Logon as $2 from $3 failed; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).node.address(0).category=unknown; \
 source(0).node.address(0).address=$3; \
 source(0).node.name=$3; \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$2; \
 last

# 2.e other
# No log sample; please submit
#regex= security\[failure\] (\d+); \
# classification.text=Windows Event ID [$1]; \
# id=1416; \
# revision=1; \
# analyzer(0).name=NTsyslog; \
# analyzer(0).manufacturer=ntsyslog.sourceforge.net; \
# analyzer(0).class=Logging; \
# assessment.impact.severity=medium; \
# assessment.impact.type=other; \
# assessment.impact.description=Security Failure message with identifier #$1; \
# last