Re: [ossec-list] stupid (?) rule question

2011-06-06 Thread Rainer
On Mon, 2011-06-06 at 14:16 -0400, dan (ddp) wrote: > Add 31100 to your rule. OK, I thought I missed something. Thank You. Steve, thanks for your hint, the solution in the link is a good approach. Maybe I can figure out how to modify it for my case. Rainer.

Re: [ossec-list] stupid (?) rule question

2011-06-06 Thread dan (ddp)
Add 31100 to your rule. On Sun, Jun 5, 2011 at 8:02 AM, Rainer wrote: > Hi, > > I want to block a certain WWW bot called verticalpigeon; it is known > to scan for Joomla! installations. You can also trigger it through the > website manually. But the nice thing is, it says > who it is: > >  66.103

Re: [ossec-list] stupid (?) rule question

2011-06-05 Thread Steven Stern
On 06/05/2011 07:02 AM, Rainer wrote: Hi, I want to block a certain WWW bot called verticalpigeon; it is known to scan for Joomla! installations. You can also trigger it through the website manually. But the nice thing is, it says who it is: 66.103.61.161 - - [05/Jun/2011:09:44:59 +0200] "GET

[ossec-list] stupid (?) rule question

2011-06-05 Thread Rainer
Hi, I want to block a certain WWW bot called verticalpigeon; it is known to scan for Joomla! installations. You can also trigger it through the website manually. But the nice thing is, it says who it is: 66.103.61.161 - - [05/Jun/2011:09:44:59 +0200] "GET /index2.php?option=com_docman HTTP/1.0"