...@googlegroups.com
Envoyé: Vendredi 26 Juin 2015 18:22:46
Objet: [ossec-list] AR command executing when it should not be
When rule 550 or 554 is hit with ANY agent as the source, the command
below is executing on agent 19.
As I understand AR, the command should only be executing on agent 19 when
good idea for a test
- Mail original -
De: LostInTheTubez lostinthetu...@gmail.com
À: ossec-list@googlegroups.com
Envoyé: Mardi 30 Juin 2015 21:57:43
Objet: RE: [ossec-list] AR command executing when it should not be
Could you add a custom rule to achieve what you’re looking
Of Jeff Blaine
Sent: Tuesday, June 30, 2015 12:14 PM
To: ossec-list@googlegroups.com
Cc: secucatc...@free.fr
Subject: Re: [ossec-list] AR command executing when it should not be
On Tuesday, June 30, 2015 at 5:27:58 AM UTC-4, secuc...@free.fr
mailto:secuc...@free.fr wrote:
i see it like
blocked each seconds.
- Mail original -
De: Jeff Blaine cjbl...@gmail.com javascript:
À: ossec...@googlegroups.com javascript:
Envoyé: Vendredi 26 Juin 2015 18:22:46
Objet: [ossec-list] AR command executing when it should not be
When rule 550 or 554 is hit with ANY agent
When rule 550 or 554 is hit with ANY agent as the source, the command below is
executing on agent 19.
As I understand AR, the command should only be executing on agent 19 when rule
550 or 554 is hit *with agent 19 as the origin*
Is this a bug or a misunderstanding on my part somewhere?
Config
On Jun 26, 2015 12:23 PM, Jeff Blaine cjbla...@gmail.com wrote:
When rule 550 or 554 is hit with ANY agent as the source, the command
below is executing on agent 19.
As I understand AR, the command should only be executing on agent 19 when
rule 550 or 554 is hit *with agent 19 as the origin*