Re: [ossec-list] Rules

2015-06-01 Thread dan (ddp)
On Mon, Jun 1, 2015 at 12:15 PM, Todd Clementz wrote: > Good Afternoon, > > > > Can anyone speak to when rules get processed. The scenario I have is I just > saw a message come in this morning that said there was a login that was > tried over the weekend. As I am trying to tune the software, I w

[ossec-list] Rules

2015-06-01 Thread Todd Clementz
Good Afternoon, Can anyone speak to when rules get processed. The scenario I have is I just saw a message come in this morning that said there was a login that was tried over the weekend. As I am trying to tune the software, I would think that if there was a violation, the notification would

Re: [ossec-list] Where are file integrity file permissions stored?

2015-06-01 Thread dan (ddp)
On Mon, Jun 1, 2015 at 12:11 PM, R Brandt wrote: > If this is documented somewhere I apoligize, I can't find it. > We are using OSSEC 2.8.1 on RedHat Linux (some 5.x, some 6.x) and using > Logstash to populate elasticsearch. > I've configured ossec to output json for logstash. The problem is that

[ossec-list] Where are file integrity file permissions stored?

2015-06-01 Thread R Brandt
If this is documented somewhere I apoligize, I can't find it. We are using OSSEC 2.8.1 on RedHat Linux (some 5.x, some 6.x) and using Logstash to populate elasticsearch. I've configured ossec to output json for logstash. The problem is that neither the size, permissions, or diffs show up in the

[ossec-list] [OSSEC] How to write decoder for Java process

2015-06-01 Thread Chandrakant Solanki
Hello All, I have one Java process which is running as daemon, on some TCP/IP port. Now I would like to find out particular line (which is pre-formatted) from application's log file. e.g. #~#~#LOGGER#~#~##~#~#..#~#~# When above line will found into log, it should mail me and

[ossec-list] Email alert.

2015-06-01 Thread Nuran Abasov
Hi i have a problem with syslog alerts. i wrote this line in config for mailing integrity changes. 11 but it send all alerts to mail. what i must also change for this? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To uns