No it monitors authentication successes and failures. This sort of thing is to help you spot unauthorised accounts created by an attacker. such as suspicious accounts being created or someone trying to brute force an account
> Date: Wed, 16 Apr 2008 16:27:07 -0400 > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > Subject: [ossec-list] Agent email alerts > > > I'm using the 1.5 beta on a Windows XP box and with a CentOS 5 server. > > > I have the email aler loglevel set to the default of 7 and I saw the > following notification: > > > SUBJECT :OSSEC Notification - (foo) d.d.d.d - Alert level 3 > OSSEC HIDS Notification. > 2008 Apr 16 15:23:43 > > Received From: (foo) 1.1.1.1->WinEvtLog > Rule: 18119 fired (level 3) -> "First time this user logged in this system." > Portion of the log(s): > > WinEvtLog: Security: AUDIT_SUCCESS(540): Security: SYSTEM: NT AUTHORITY: > <scrub>: Successful Network Logon: User Name: <scrub> Domain: > foo Logon ID: <scrub> Logon Type: 3 Logon > Process: > Kerberos Authentication Package: Kerberos Workstation Name: > Logon GUID: <scrubbed> > > > > --END OF NOTIFICATION > > > I'm guessing this is an error? > > Thanks, > Rob _________________________________________________________________ Get Hotmail on your mobile. Text MSN to 63463 now! http://mobile.uk.msn.com/pc/mail.aspx
