#FULLNAME:NETSCAPE
#VERSION: 1.0
#DESCRIPTION: Old web browser allowing you to surf the web as if you were in the 1990's

#####
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####

#DESCRIPTION:Unsuccessful HTTP GET request in Netscape
#CATEGORY:Web browser
#LOG:10.0.0.1 - - [06/Jul/2010:11:51:07 -0000] "GET http://www.google.com/ HTTP/1.0" 000 0 000 0 0 0 204 250 233 222 60
regex=netscape: result:(\S+) - (\S+) (?:\S+ -[0-9]{4}\]) \"(\S+) (\S+) (\S+)\" ([0-9]{3}) [0-9] ([0-9]{3})
 id=36000; \
 analyzer(0).name=Netscape; \
 analyzer(0).manufacturer=AOL; \
 classification.text=Unsuccessful HTTP request; \
 assessment.impact.severity=low; \
 assessment.impact.completion=failed; \
 assessment.impact.type=user; \
 assessment.impact.description=The user tried to access $4 but it was unsuccessful, with status code $7 from the server.; \
 source(0).user.user_id(0).name=$2; \
 source(0).node.address(0).address=$1; \
 source(0).service.iana-protocol-number=80; \
 source(0).service.iana-protocol-name=$5; \
 target(0).service.web_service.url=$4; \
 target(0).service.web_service.http_method=$3; \
 additional_data(0).type=string; \
 additional_data(0).meaning=status code returned by the proxy to the host; \
 additional_data(0).data=$7; \
 additional_data(1).type=string; \
 additional_data(1).meaning=status code returned by the server to the proxy; \
 additional_data(1).data=$6; \