[ossec-list] tcp-syn-flood-attack

Hi, I want to block a TCP-SYN-FLOOD attacker attacking my server. I have launched the attack but I can't see any logs. How can we detect that there is flooding at the SERVER. Please help.

[ossec-list] log_format : full_command questions

Hello list, Is there a way to determine if a full command has been run. Like you can see that syscheck has run with agent_control command from the server? This is needed to troubleshoot frequency scheduling of the command . Similar to the above as we can see with syscheck_control the list of

[ossec-list] win_client_response

Hi, I have defined a rule in local_rules for multiple authentication failures:: 18106 Multiple Windows Logon Failure events. I can see the alert for the same rule I have added, but having two problems: 1)Rule is not triggering on 2 failure attempts (freq=2), but on 3 or more failur

Re: [ossec-list] win_client_response

On Fri, Jul 13, 2012 at 7:01 AM, sahil sharma wrote: > Hi, > > I have defined a rule in local_rules for multiple authentication failures:: > > > > 18106 > Multiple Windows Logon Failure events. > > > I can see the alert for the same rule I have added, but having two problems: > > 1)Rule

Re: [ossec-list] log_format : full_command questions

On Fri, Jul 13, 2012 at 6:52 AM, alsdks wrote: > Hello list, > > Is there a way to determine if a full command has been run. Like you can see > that syscheck has run with agent_control command from the server? > This is needed to troubleshoot frequency scheduling of the command . > If you have th

Re: [ossec-list] tcp-syn-flood-attack

On Fri, Jul 13, 2012 at 4:06 AM, sahil sharma wrote: > Hi, > > I want to block a TCP-SYN-FLOOD attacker attacking my server. > I have launched the attack but I can't see any logs. > > How can we detect that there is flooding at the SERVER. > > Please help. OSSEC doesn't detect scans like this by

Re: [ossec-list] ossec not blocking attackers anymore

On Thu, Jul 12, 2012 at 8:05 PM, cosmaschi cristian wrote: > I have nothing in hosts.deny > > but i see something weird in the logs > tail -f /var/ossec/logs/active-responses.log > > > > > Thu Jul 12 19:54:47 EDT 2012 Unable to run (iptables returning != 2): 1 - > /var/ossec/active-response/bin/

Re: [ossec-list] tcp-syn-flood-attack

2012/7/13 sahil sharma : > Hi, > > I want to block a TCP-SYN-FLOOD attacker attacking my server. > I have launched the attack but I can't see any logs. > > How can we detect that there is flooding at the SERVER. You need some way to detect tcp-syn-flooding, maybe using custom iptables rules? I th

[ossec-list] Rule not FIring?

Good afternoon, there's every chance I'm missing something obvious, if so a mild beating with the cluebat woul be welcomed. I'm trying to get an alert raised from the output of a script (a simple test Windows batch file in this case). The batch file is: echo off echo date_test: date /t I hav

Re: [ossec-list] Rule not FIring?

On Fri, Jul 13, 2012 at 12:17 PM, Nick Davies wrote: > Good afternoon, > > there's every chance I'm missing something obvious, if so a mild beating > with the cluebat woul be welcomed. > > I'm trying to get an alert raised from the output of a script (a simple test > Windows batch file in this cas

Re: [ossec-list] Rule not FIring?

>

Re: [ossec-list] Rule not FIring?

On Fri, Jul 13, 2012 at 12:37 PM, Nick Davies wrote: >>

[ossec-list] Ossec syslog

So, I've been looking for a while and haven't found a straight answer(maybe I just missed it), but can individual ossec agents forward their logs to a syslog server instead of to an ossec server? I want to send logs to a central logging server that's already in place. Is that possible? Sorry if

Re: [ossec-list] Ossec syslog

The agent can only log to the central ossec server. From there you can forward logs to a central syslog server. Hope that helps. -Shawn On Jul 13, 2012 3:50 PM, "carrothospital" wrote: > So, I've been looking for a while and haven't found a straight > answer(maybe I just missed it), but can indi