Hello list,
I'm trying to stop sending an e-mail alert when a rule fires and certain
criteria are matched, as per
http://www.ossec.net/wiki/index.php/Know_How:Ignore_Rules#Ignoring_syslog_message
Here's the alert I'm currently receiving:
Received From: Snort02/Snort02->/path/to/snort.log
Rule: 5104 fired (level 8) -> "Interface entered in promiscuous(sniffing) mode."
Portion of the log(s):
Aug 20 09:39:49 Snort02/Snort02 kernel: xl0: promiscuous mode enabled
I'm restarting Snort every hour, which means I'm getting the above e-mail alert
every hour. I've added the following rule to local_rules.xml:
<!-- Ignore Snort02 going into promisc mode -->
<rule id="103004" level="0">
<if_sid>5104</if_sid>
<match>Snort02</match>
<description>Interface (xl0) entered promiscuous mode on
Snort02</description>
</rule>
I then restarted the OSSEC server, gave it a minute, then restarted Snort, and
I still get the e-mail alert.
Is there something wrong with my syntax? I'm running 1.4 (yes, I know, I need
to upgrade :)
Thanks,
Kevin
This message may contain confidential or proprietary information and is
intended solely for the individual(s) to whom it is addressed. If you are not
a named addressee you should not disseminate, distribute or copy this e-mail or
act upon the information contained herein. Please notify the sender
immediately by e-mail if you have received this e-mail by mistake and delete
this e-mail from your system.
