Re: [ossec-list] active-response for new files added to the system

[dan (ddp)]

I don't believe you can pass the filename to AR.
On May 23, 2011 1:26 PM, "frankstefan" <frankste...@gmail.com> wrote:
> Hi.
>
> Is it possible to make a active-response script take filenanames as
> arguments?
>
> Scenario is a new file is added to a node
> the node reports the filename to the master and the master then sends
> active response with the given file name as an argument.