Re: [ossec-list] OSSEC agent limit modification after server install

- Original Message - > Is there a command that can be run to change the max agents per manager? > > The OSSEC server has already been installed so I cannot find a way to run > the following: > > *Can an OSSEC manager have more than 256 agents?* > *By default OSSEC limits the number

Re: [ossec-list] Re: Active response to email abuse contact of IP block owner?

with OSSEC? Ryan On Wednesday, December 21, 2011 10:32:41 AM UTC-6, Chris Warren wrote: blockquote Hi all, Has anyone attempted, or done this? When triggered, it would look up the whois record for the IP and find the abuse contact, sending them an email with the notification. Just wanted

Re: [ossec-list] csf firewall

Message - From: dan (ddp) ddp...@gmail.com To: ossec-list@googlegroups.com Sent: Tuesday, January 15, 2013 9:54:30 AM Subject: Re: [ossec-list] csf firewall On Mon, Jan 14, 2013 at 4:22 PM, Chris Warren chris.war...@netelligent.ca wrote: Hi all, Has anyone set up a decoder for csf firewall logs

[ossec-list] csf firewall

Hi all, Has anyone set up a decoder for csf firewall logs? They are pretty similar to the shorewall logs, but with a few differences. I'm not great with the regex's and whatnot, so I haven't been able to decode the action. Any help appreciated. Chris

Re: [ossec-list] 2.6 ossec debian package 2.7 ossec puppet module

Wow! I was actually just coming to write in and see if a deb repo with deb builds would be a useful way to contribute. I have just worked on a project that required puppet, and I found myself writing a lot of execs to get agents registered etc. (the new agent-authd was a HUGE help, btw). I

[ossec-list] Active response to email abuse contact of IP block owner?

Hi all, Has anyone attempted, or done this? When triggered, it would look up the whois record for the IP and find the abuse contact, sending them an email with the notification. Just wanted to check around before adding it to my to-do list ;) Being the abuse contact for about 25,000 IPs, I get

Re: [ossec-list] Re: Repeated Offenders not triggering

to repeated_offenders :) Thanks again, Jake, for the tested you did with this, and thanks Dan for updating the docs :) - Original Message - From: Chris Warren chris.war...@netelligent.ca To: ossec-list@googlegroups.com Sent: Saturday, December 17, 2011 10:37:41 AM Subject: Re: [ossec-list] Re: Repeated

Re: [ossec-list] Re: Repeated Offenders not triggering

currently which would of been nice, but it's fine for now. For more details on this see my post on this solution here: http://www.mebsd.com/freebsd-security-hardening/solved-ossec-repeated-offenders-ignored.html Regards Jake On Dec 17, 4:57 am, Chris Warren chris.war...@netelligent.ca wrote: Good

Re: [ossec-list] Repeated Offenders not triggering

see anything in the log on start either. Is this feature confirmed as working? Just doesn't seem to have many docs for it, would be a nice feature to use. Jake Sent using BlackBerry® from Orange -Original Message- From: Chris Warren chris.war...@netelligent.ca Sender: ossec-list

Re: [ossec-list] Repeated Offenders not triggering

through the source. Any of the developers know much about this? -Original Message- From: Chris Warren chris.war...@netelligent.ca Sender: ossec-list@googlegroups.com Date: Fri, 16 Dec 2011 14:41:38 To: ossec-list@googlegroups.com Reply-To: ossec-list@googlegroups.com Subject: Re: [ossec-list

Re: [ossec-list] Repeated Offenders not triggering

this will be for me to test. On Mon, Dec 12, 2011 at 10:08 PM, Chris Warren chris.war...@netelligent.ca wrote: Hi, I'm am trying out the repeated_offenders option but it does not seem to be triggering. Here is my active response config:  active-response    !-- Firewall Drop response. Block

[ossec-list] Repeated Offenders not triggering

Hi, I'm am trying out the repeated_offenders option but it does not seem to be triggering. Here is my active response config: active-response !-- Firewall Drop response. Block the IP for - 600 seconds on the firewall (iptables, - ipfilter, etc). --