>
> What I was referring to is that the message has an alert
> level of 3, but the default as I understand it is to only
> send an alert if the even is of a level of 7 or greater? I'm
> just trying to understand why I was emailed this alert, not
> why it happened.
>
> Thanks,
> Rob Skoog
Look at the rule:
<rule id="18119" level="3">
<if_sid>18107</if_sid>
<options>alert_by_email</options>
<if_fts />
<description>First time this user logged in this system.</description>
<group>authentication_success,</group>
</rule>
The 'alert_by_email' overrides the default setting.
-- tim --
> ----- Original Message -----
> From: "Kevin Ross" <[EMAIL PROTECTED]>
> To: [email protected]
> Sent: Wednesday, April 16, 2008 6:16:55 PM GMT -05:00
> US/Canada Eastern
> Subject: [ossec-list] Re: Agent email alerts
>
>
> No it monitors authentication successes and failures. This
> sort of thing is to help you spot unauthorised accounts
> created by an attacker. such as suspicious accounts being
> created or someone trying to brute force an account
>
>
>
>
> > Date: Wed, 16 Apr 2008 16:27:07 -0400
> > From: [EMAIL PROTECTED]
> > To: [EMAIL PROTECTED]
> > Subject: [ossec-list] Agent email alerts
> >
> >
> > I'm using the 1.5 beta on a Windows XP box and with a
> CentOS 5 server.
> >
> >
> > I have the email aler loglevel set to the default of 7 and
> I saw the
> > following notification:
> >
> >
> > SUBJECT :OSSEC Notification - (foo) d.d.d.d - Alert level 3
> > OSSEC HIDS Notification.
> > 2008 Apr 16 15:23:43
> >
> > Received From: (foo) 1.1.1.1->WinEvtLog
> > Rule: 18119 fired (level 3) -> "First time this user logged
> in this system."
> > Portion of the log(s):
> >
> > WinEvtLog: Security: AUDIT_SUCCESS(540): Security: SYSTEM:
> NT AUTHORITY:
> > <scrub>: Successful Network Logon: User Name: <scrub> Domain:
> > foo Logon ID: <scrub> Logon Type: 3 Logon Process:
> > Kerberos Authentication Package: Kerberos Workstation Name:
> > Logon GUID: <scrubbed>
> >
> >
> >
> > --END OF NOTIFICATION
> >
> >
> > I'm guessing this is an error?
> >
> > Thanks,
> > Rob
>
>
> A prize an hour, 24 hours a day. Try Big Snap now!
