Hi Brad,
My guess is you have extended auditing enabled. Both of these alerts are
typical of access requests (file handles) or successful use of privs - in
both cases, I would be more interested in failed use of privs and/or
blocked access. However, you have to judge for your environment. Without
knowing everything about your setup, I would say you could probably safely
ignore these for now, then focus on the rest of the alerts to try to get a
clear understanding of what "normal" is.
Cheers
Kat
On Friday, July 8, 2016 at 2:34:20 PM UTC-5, Brad Carey wrote:
>
> We have deployed OSSEC company wide to probably 60-80 PCs and servers.
> Problem is our hourly emails are 4-5MB, way too much to wade through. The
> vast majority of the events are Event ID 4656, with a good number of Event
> ID 4673 too. How do I determine whether or not I can suppress all of these
> from the alert emails? I don't mean in the technical sense, but security
> sense. Might these particular events ever be thrown when there is malicious
> activity?
>
> Thanks!
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
