Re: [ossec-list] RE: Active Response on Public Web Server

2010-10-14 Thread Jeremy Lee
It really depends on what your script does. Active Response doesn't technically "block" anything - it just allows for passing of certain parameters/variables to scripts so that you can take actionable measures. Explaining it that way might help... although, it might confuse him even more! But one e

[ossec-list] RE: Active Response on Public Web Server

2010-10-14 Thread Toby
Thanks all for your responses. Just to be clear: I am not currently under attack. When my boss found out that I'd enabled something that could block IP's from our web site, he became anxious. I just wanted to explore the possibility that Active Response could cause more problems than it prevents.