On Thu, Aug 9, 2018 at 8:58 AM, Dzenis Aslani <dzenis.asl...@gmail.com> wrote: > Hmm i think so, i care about local logins and also anyone who is trying to > enter the server (login attempts) . Could you provide me rule or changes > which i have to apply to conf file >
Not with so little information. Get some log samples that you would like alerts for. Provide them here (change the names and IPs if you want). > On Thursday, August 9, 2018 at 2:52:57 PM UTC+2, dan (ddpbsd) wrote: >> >> On Thu, Aug 9, 2018 at 6:39 AM, Dzenis Aslani <dzenis...@gmail.com> wrote: >> > Hello everyone, im new to OSSEC, and i wanna know how to create an email >> > alert when somebody is try to login or was successfully loged in into >> > the >> > server ? >> > >> >> Do you have a log sample of a successful login? >> Are you worried about local logins, ssh logins, something else? >> >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to ossec-list+...@googlegroups.com. >> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
