I'm using the 1.5 beta on a Windows XP box and with a CentOS 5 server.
I have the email aler loglevel set to the default of 7 and I saw the
following notification:
SUBJECT :OSSEC Notification - (foo) d.d.d.d - Alert level 3
OSSEC HIDS Notification.
2008 Apr 16 15:23:43
Received From: (foo) 1.1.1.1->WinEvtLog
Rule: 18119 fired (level 3) -> "First time this user logged in this system."
Portion of the log(s):
WinEvtLog: Security: AUDIT_SUCCESS(540): Security: SYSTEM: NT AUTHORITY:
<scrub>: Successful Network Logon: User Name: <scrub> Domain:
foo Logon ID: <scrub> Logon Type: 3 Logon Process:
Kerberos Authentication Package: Kerberos Workstation Name:
Logon GUID: <scrubbed>
--END OF NOTIFICATION
I'm guessing this is an error?
Thanks,
Rob
