good idea for a test ----- Mail original ----- De: "LostInTheTubez" <lostinthetu...@gmail.com> À: ossec-list@googlegroups.com Envoyé: Mardi 30 Juin 2015 21:57:43 Objet: RE: [ossec-list] AR command executing when it should not be
Could you add a custom rule to achieve what you’re looking for? Something like: <rule id=”100000” level=”7”> <if_sid>550,554</if_sid> <hostname>hostnameexample|hostnameexample2</hostname> <description>550 or 554 event that occurred on hostnameexample or hostnameexampmle2</description> </rule> …Then trigger your active response off of 100000 instead of 550 or 554? This is untested and I just manually typed out the rule, so beware typos if you are copy/pasting. From: ossec-list@googlegroups.com [mailto:ossec-list@googlegroups.com] On Behalf Of Jeff Blaine Sent: Tuesday, June 30, 2015 12:14 PM To: ossec-list@googlegroups.com Cc: secucatc...@free.fr Subject: Re: [ossec-list] AR command executing when it should not be On Tuesday, June 30, 2015 at 5:27:58 AM UTC-4, secuc...@free.fr wrote: i see it like a feature, and it works like a cluster of information. We discover it on in very bad case! It's a feature and a design flaw, IMO. The feature part is as you described. The design flaw is that Active Response doesn't allow one to generically "act only on the host where the problem was found". In the case of, for example, one host's /var/www/html directory contents changes (syscheck sees a new file added), an action should be able to be configured (generically) to act only on that host . Perhaps send the file to an alert team. when an ip is triggering an alert, all the servers block this ip. It protects more the datacenter, but it could really go wrong and the second problem is if you put a lot of servers/ rules in AR you could have performance problem with a thousands of ip blocked each seconds. ----- Mail original ----- De: "Jeff Blaine" < cjbl...@gmail.com > À: ossec...@googlegroups.com Envoyé: Vendredi 26 Juin 2015 18:22:46 Objet: [ossec-list] AR command executing when it should not be When rule 550 or 554 is hit with ANY agent as the source, the command below is executing on agent 19. As I understand AR, the command should only be executing on agent 19 when rule 550 or 554 is hit *with agent 19 as the origin* Is this a bug or a misunderstanding on my part somewhere? Config piece: <active-response> <command>test-it</command> <location>defined-agent</location> <agent_id>019</agent_id> <rules_id>550,554</rules_id> </active-response> -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com . For more options, visit https://groups.google.com/d/optout . -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com . For more options, visit https://groups.google.com/d/optout . -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com . For more options, visit https://groups.google.com/d/optout . -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
