What I was referring to is that the message has an alert level of 3, but the default as I understand it is to only send an alert if the even is of a level of 7 or greater? I'm just trying to understand why I was emailed this alert, not why it happened.
Thanks, Rob Skoog ----- Original Message ----- From: "Kevin Ross" <[EMAIL PROTECTED]> To: [email protected] Sent: Wednesday, April 16, 2008 6:16:55 PM GMT -05:00 US/Canada Eastern Subject: [ossec-list] Re: Agent email alerts No it monitors authentication successes and failures. This sort of thing is to help you spot unauthorised accounts created by an attacker. such as suspicious accounts being created or someone trying to brute force an account > Date: Wed, 16 Apr 2008 16:27:07 -0400 > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > Subject: [ossec-list] Agent email alerts > > > I'm using the 1.5 beta on a Windows XP box and with a CentOS 5 server. > > > I have the email aler loglevel set to the default of 7 and I saw the > following notification: > > > SUBJECT :OSSEC Notification - (foo) d.d.d.d - Alert level 3 > OSSEC HIDS Notification. > 2008 Apr 16 15:23:43 > > Received From: (foo) 1.1.1.1->WinEvtLog > Rule: 18119 fired (level 3) -> "First time this user logged in this system." > Portion of the log(s): > > WinEvtLog: Security: AUDIT_SUCCESS(540): Security: SYSTEM: NT AUTHORITY: > <scrub>: Successful Network Logon: User Name: <scrub> Domain: > foo Logon ID: <scrub> Logon Type: 3 Logon Process: > Kerberos Authentication Package: Kerberos Workstation Name: > Logon GUID: <scrubbed> > > > > --END OF NOTIFICATION > > > I'm guessing this is an error? > > Thanks, > Rob A prize an hour, 24 hours a day. Try Big Snap now!
