Re: [ossec-list] Multiple agent_id for one active response

2016-09-05 Thread secucatcher
hi 003,004 doesn't work but each section separetely is working firewall-drop defined-agent 067 864000 117154,31510,117159,117162 firewall-drop defined-agent 038 864000 117154,31510,117159,117162 be carefull with that case https://github.com/ossec/oss

[ossec-list] Different branches?

2016-09-05 Thread Kat
Hi all, Trying to figure out the different branches right now and what has been integrated and what has not. Right now there seems to be the main branch, then there is Dan's - (is that the main branch too?) and then there is Wazuh, and of course Atomic. Can someone summarize the different bra

Re: [ossec-list] Different branches?

2016-09-05 Thread dan (ddp)
On Mon, Sep 5, 2016 at 8:47 AM, Kat wrote: > Hi all, > > Trying to figure out the different branches right now and what has been > integrated and what has not. Right now there seems to be the main branch, > then there is Dan's - (is that the main branch too?) and then there is > Wazuh, and of cour

[ossec-list] ossec email notification not working

2016-09-05 Thread Daiyue Weng
Hi, I installed ossec local on my cloud server, and configure ossec.conf as follows, I tried to detect new additions using yes. yes my_em...@example.com ns0.bt.net. my_em...@example.com 79200 yes /etc,/usr/bin,/usr/sbin /bin,/sbin /

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread dan (ddp)
On Mon, Sep 5, 2016 at 10:33 AM, Daiyue Weng wrote: > Hi, I installed ossec local on my cloud server, and configure ossec.conf as > follows, I tried to detect new additions using > yes. > > > yes > my_em...@example.com > ns0.bt.net. > my_em...@example.com > > > >

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread Daiyue Weng
Hi, since it is a fresh install of ossec, so I didn't get any emails. The notification is turn on as yes in ossec.conf On Monday, 5 September 2016 15:38:25 UTC+1, dan (ddpbsd) wrote: > > On Mon, Sep 5, 2016 at 10:33 AM, Daiyue Weng > wrote: > > Hi, I installed ossec local on my cloud server,

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread dan (ddp)
On Mon, Sep 5, 2016 at 10:47 AM, Daiyue Weng wrote: > Hi, since it is a fresh install of ossec, so I didn't get any emails. The > notification is turn on as > Try using tcpdump (looking for connections to the email server from the OSSEC system) or check the maillogs on the email server to determ

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread Daiyue Weng
Hi, could you give me an example of using tcpdump in this case? cheers On Monday, 5 September 2016 15:57:08 UTC+1, dan (ddpbsd) wrote: > > On Mon, Sep 5, 2016 at 10:47 AM, Daiyue Weng > wrote: > > Hi, since it is a fresh install of ossec, so I didn't get any emails. > The > > notification is

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread dan (ddp)
On Mon, Sep 5, 2016 at 11:42 AM, Daiyue Weng wrote: > Hi, could you give me an example of using tcpdump in this case? > tcpdump -nnXxevvs 0 port 25 > cheers > > On Monday, 5 September 2016 15:57:08 UTC+1, dan (ddpbsd) wrote: >> >> On Mon, Sep 5, 2016 at 10:47 AM, Daiyue Weng wrote: >> > Hi, sin

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread Daiyue Weng
Using the above cmd, adding a file on a monitored directory, i.e. /home/user_name, nothing is shown on tcpdump, tcpdump: listening on dummy0, link-type EN10MB (Ethernet), capture size 262144 bytes On Monday, 5 September 2016 16:44:57 UTC+1, dan (ddpbsd) wrote: > > On Mon, Sep 5, 2016 at 11:

Re: [ossec-list] Multiple agent_id for one active response

2016-09-05 Thread C. L. Martinez
On Mon 5.Sep'16 at 8:59:41 +0200, secucatc...@free.fr wrote: > hi > 003,004 doesn't work > but each section separetely is working > > > firewall-drop > defined-agent > 067 > 864000 > 117154,31510,117159,117162 > > > > firewall-drop > defined-agent > 038 >

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread dan (ddp)
On Mon, Sep 5, 2016 at 11:53 AM, Daiyue Weng wrote: > Using the above cmd, adding a file on a monitored directory, i.e. > /home/user_name, > > nothing is shown on tcpdump, > > tcpdump: listening on dummy0, link-type EN10MB (Ethernet), capture size > 262144 bytes > > You can use "-i INTERFACE_NAME

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread Daiyue Weng
The /var/ossec/logs/alerts/alerts.log didn't show the addition of the file, no alerts fired after adding a file to /home/user_name, which is monitored by ossec. what's the possible problems? On Monday, 5 September 2016 17:02:06 UTC+1, dan (ddpbsd) wrote: > > On Mon, Sep 5, 2016 at 11:53 AM, Daiy

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread dan (ddp)
On Mon, Sep 5, 2016 at 12:14 PM, Daiyue Weng wrote: > The /var/ossec/logs/alerts/alerts.log didn't show the addition of the file, > no alerts fired after adding a file to /home/user_name, which is monitored > by ossec. what's the possible problems? > A syscheck scan probably hasn't run since the

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread Daiyue Weng
Hi, ideally we like ossec to check file integrity in real time, if not, what are the other options ossec can offer in that aspect? Is there a Syscheck cmd in ossec? On 5 September 2016 at 17:23, dan (ddp) wrote: > On Mon, Sep 5, 2016 at 12:14 PM, Daiyue Weng wrote: > > The /var/ossec/logs/aler

Re: [ossec-list] ossec email notification not working

2016-09-05 Thread dan (ddp)
On Mon, Sep 5, 2016 at 12:29 PM, Daiyue Weng wrote: > Hi, ideally we like ossec to check file integrity in real time, if not, what > are the other options ossec can offer in that aspect? > It will do some things in real time, not all. I think it should be a fairly simple code change to add new fi