Thank Rick,
Already found the | way to make an OR.
Multiple lines certainly I guess they're also an OR, as for example default
rule 31103.
<rule id="31103" level="6">
<if_sid>31100</if_sid>
<url>='|select%20|select+|insert%20|%20from%20|%20where%20|union%20|</url>
<url>union+|where+|null,null|xp_cmdshell</url>
<description>SQL injection attempt.</description>
<group>attack,sql_injection,</group>
</rule>
Another question I have now... it's possible to have separate alerts level for
separate emails?? It is, I wish something like:
ALL alerts level > 6 : email to operator@
ALL alerts level > 10 : email to sysadmin@
ALL alerts level > 14 : email to blackberry@
I'm only seeing a single point of global level configuration.
<alerts>
<log_alert_level>1</log_alert_level>
<email_alert_level>6</email_alert_level>
</alerts>
And the last question and prolly the foolish one... there is no exhaustive
documentation about all configuration options and rules syntax, right?
Thank you all!
Xavi.
________________________________________
De: [email protected] [[email protected]] En nom de
McClinton, Rick [[email protected]]
Enviat el: dimecres, 21 / gener / 2009 18:24
Per a: [email protected]
Tema: [ossec-list] Re: RV: Rule questions
Xavier wrote:
> What happens when tehre are 2 <match> or 2 <url>.. that acts as OR or as AND
> ?!?
2 match as in <match>ONE|TWO</match> or as in <match>one</match>
<match>two</match> ?
First example I know is OR, I'm not sure what will happen per the second
example, I think it is still OR.
Thanks,
Rick
This message contains TMA Resources confidential information and is intended
only for the individual named. If you are not the named addressee you should
not disseminate, distribute or copy this e-mail. Please notify the sender
immediately by e-mail if you have received this e-mail by mistake and delete
this e-mail from your system. E-mail transmission cannot be guaranteed to be
secure or error-free as information could be intercepted, corrupted, lost,
destroyed, arrive late or incomplete, or contain viruses. The sender therefore
does not accept liability for any errors or omissions in the contents of this
message which arise as a result of e-mail transmission. If verification is
required please request a hard-copy version.
