Hi all I have a few questions on white listing and active response; Even though I've white listed our network (using CIDR format, on our server, not the agents) I noticed that some hosts on our network were getting blacklisted. Today I was able to catch one while the black listing happened and the iptables rules (on a linux host) showed the block was by hostname instead of IP address. The active response logfile showed the same (I'm assuming that ossec is doing a reverse lookup on the offending IP address to get a hostname). So I have a few questions. 1. Is it therefore appropriate to also white list our domain name as well? 2. If so, if our dns namespace was gmail.com, would the white list rule look like this (assume our hosts are named hostname.dnsname) and have corresponding forward and reverse dns entries: <white_list>^gmail.com$</white_list>
3. Are there any security issues with adding this, other than any hosts with a hostname of *.gmail.com would not be black listed? Thanks for your help. Aaron
