On Wed, Feb 9, 2011 at 12:00 AM, tayebeh amiri <t.amiri1...@gmail.com> wrote: > so,what should i do?i want to eject usb in agent when some specific rule > occures. > but i can't find a script without arguments.plz help me. >
Don't know. Maybe you can add support to OSSEC to pass more than just srcip and dstuser. > On Tue, Feb 8, 2011 at 6:18 PM, dan (ddp) <ddp...@gmail.com> wrote: >> >> No, it's not currently possible. >> >> On Tue, Feb 8, 2011 at 1:25 AM, tayebe <t.amiri1...@gmail.com> wrote: >> > hi all. >> > i have another question about active response. >> > i wana execute an script with some arguments,except srcip and user.is >> > there possible?what should i do if not? >> > appreciate you before > >
