RE: [ossec-list] Detecting the Apache Range Header DoS Attack

2011-09-07 Thread Mike Disley
@googlegroups.com Subject: [ossec-list] Detecting the Apache Range Header DoS Attack http://www.immutablesecurity.com/index.php/2011/08/28/detecting-the-apache-range-header-dos-attack-with-ossec/ Testing of the rules and feedback appreciated.

Re: [ossec-list] Detecting the Apache Range Header DoS Attack

2011-09-07 Thread Frank Stefan Sundberg Solli
@googlegroups.com] On Behalf Of Michael Starks Sent: Sunday, August 28, 2011 12:42 PM To: ossec-list@googlegroups.com Subject: [ossec-list] Detecting the Apache Range Header DoS Attack http://www.immutablesecurity.com/index.php/2011/08/28/detecting-the-apache-range-header-dos-attack-with-ossec

RE: [ossec-list] Detecting the Apache Range Header DoS Attack

2011-09-07 Thread Mike Disley
[mailto:ossec-list@googlegroups.com] On Behalf Of Frank Stefan Sundberg Solli Sent: Wednesday, September 07, 2011 2:48 PM To: ossec-list@googlegroups.com Subject: Re: [ossec-list] Detecting the Apache Range Header DoS Attack Thats local_rules On Wed, Sep 7, 2011 at 9:40 AM, Mike Disley mike.a.dis...@tpsgc

Re: [ossec-list] Detecting the Apache Range Header DoS Attack

2011-09-07 Thread dan (ddp)
: Wednesday, September 07, 2011 2:48 PM To: ossec-list@googlegroups.com Subject: Re: [ossec-list] Detecting the Apache Range Header DoS Attack Thats local_rules On Wed, Sep 7, 2011 at 9:40 AM, Mike Disley mike.a.dis...@tpsgc-pwgsc.gc.ca wrote: Excellent write up.  Would you put this rule

Re: [ossec-list] Detecting the Apache Range Header DoS Attack

2011-09-07 Thread dan (ddp)
@googlegroups.com [mailto:ossec-list@googlegroups.com] On Behalf Of Michael Starks Sent: Sunday, August 28, 2011 12:42 PM To: ossec-list@googlegroups.com Subject: [ossec-list] Detecting the Apache Range Header DoS Attack http://www.immutablesecurity.com/index.php/2011/08/28/detecting-the-apache

Re: [ossec-list] Detecting the Apache Range Header DoS Attack

2011-09-07 Thread Michael Starks
On 09/07/2011 08:40 AM, Mike Disley wrote: Excellent write up. Would you put this rule in the local_rules or web_rules file? Cheers, Mike Thanks for the feedback. Do they work? :) Custom rules always go into local_rules.xml. We will probably include this in the next release, at which

[ossec-list] Detecting the Apache Range Header DoS Attack

2011-08-28 Thread Michael Starks
http://www.immutablesecurity.com/index.php/2011/08/28/detecting-the-apache-range-header-dos-attack-with-ossec/ Testing of the rules and feedback appreciated.