bsmtrace.conf

#
# Define subject (or user) groupings
#
define set $fwadmins <auid> {
	csjp;
};

#
# Define various event groups that we are interested in
#
define set $execution <auditevent> {
	AUE_EXEC,
	AUE_EXECVE;
};

define set $login <auditevent> {
	AUE_openssh,
	AUE_login,
	AUE_su;
};

#
# Define our object (or file) groups
#
define set $trusteddirs <path> {
	/bin,
	/sbin,
	/usr/bin,
	/usr/sbin,
	/usr/local/bin,
	/usr/X11R6/bin,
	/usr/local/sbin,
	/usr/games;
};

define set $opendirs <path> {
	/tmp,
	/var/tmp;
};

define set $fwtools <path> {
	/sbin/pfctl;
};

############################################################
#
# Define our state machines or actual "IDS signatures"
#
############################################################

sequence firewall.change.attempt {
	subject not $fwadmins;
	state {
		event $execution;
		object $fwtools;
		status any;
	};
};

sequence non.trusted.exec {
	subject any;
	state {
		event $execution;
		object not $trusteddirs;
		status success;
	};
};

sequence mktemp.race {
	subject any;
	state {
		event <auditevent> { AUE_SYMLINK; };
		object $opendirs;
		status success;
	};
};

sequence login.brute.force {
	subject any;
	state {
		event $login;
		status failure;
		multiplier 2;
	};
	state {
		event $login;
		status success;
	};
};

sequence login {
	subject any;
	state {
		event $login;
		status success;
	};
};