[ossec-list] Rule Exception - How?

2017-11-20 Thread Bruce Westbrook
Looking for help on making an exception for a specific username that's continually failing logons to a database. The DBAs are slammed and unable to get to this for a few days. In the meantime, I'm getting slammed with an excessive amount of email alerts (500+) from rule #18180 every day. My g

Re: [ossec-list] Centralized configuration for Windows agents

2017-11-20 Thread Chema Martinez
Hello Sylvain, As you have said, the ossec.conf file is populated with a default configuration when you install the Windows agent. However, this default configuration is never going to have any conflict due to the agent.conf and the ossec.conf are merged. During that merge, the agent.conf overwr

[ossec-list] Centralized configuration for Windows agents

2017-11-20 Thread Sylvain Crouet
Hello, I set OSSEC up to have a centralized agent configuration for Windows agents. As far as I understand, there must be no duplicate between the ossec.conf file and the agent.conf file locally on the agent. Unfortunately, when I install the agent with the .exe installer, the ossec.conf file i