I am thinking of monitoring the sguild.logs for snort alerts such as the below that decoders would have to be made for ( which I am weak on ):
2016-05-12 16:08:58 pid(2410) Sending sock222f690: InsertEvent {0 0 unknown alamo-eth1-1 {2016-05-12 16:08:58} 3 106 {Port Scan} 10.40.2.75 10.40.3.253 6 56496 10247 1 9000001 0 8 8 1} On Tuesday, May 10, 2016 at 3:35:26 PM UTC-5, Jacob Mcgrath wrote: > > Is it possible to have Ossec monitor Snort logs for certain Sid's and then > trigger the active response on all agents when event occurs. > > Looking at reacting to Nmap and Nessus type scans on my internal network. > > > I guess I would have to monitor the Security Onion servers snort log for > Sid's for port scans. > > In the Security Onion server I have /etc/nsm/rules/local.rules > > > # look for stealth port scans/sweeps > alert tcp any any -> any any (msg:"SYN FIN Scan"; flags: SF;sid:9000000;) > alert tcp any any -> any any (msg:"FIN Scan"; flags: F;sid:9000001;) > alert tcp any any -> any any (msg:"NULL Scan"; flags: 0;sid:9000002;) > alert tcp any any -> any any (msg:"XMAS Scan"; flags: FPU;sid:9000003;) > alert tcp any any -> any any (msg:"Full XMAS Scan"; flags: SRAFPU;sid: > 9000004;) > alert tcp any any -> any any (msg:"URG Scan"; flags: U;sid:9000005;) > alert tcp any any -> any any (msg:"URG FIN Scan"; flags: FU;sid:9000006;) > alert tcp any any -> any any (msg:"PUSH FIN Scan"; flags: FP;sid:9000007;) > alert tcp any any -> any any (msg:"URG PUSH Scan"; flags: PU;sid:9000008;) > alert tcp any any -> any any (flags: A; ack: 0; msg:"NMAP TCP ping!";sid: > 9000009;) > > > > > How would one write the local local.rules for the Ossec server to trigger > active responses route-null function on agents. > > > 1. Snort see's port scans and writes alert to log > 2. Ossec see's snorts port scan alerts in log and triggers route-null on > all agents. > > I there a guide to setting something like this up ? > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.