Hi Daniel:
I found the rule which worked well under all prior versions, but
chokes under 2.3:
<rule id="30114" level="3" frequency="30" timeframe="45"
overwrite="yes">
<if_matched_sid>30112</if_matched_sid>
<same_source_ip />
<description>Multiple attempts to access non-existent </
description>
<description>files (web scan) from same source.</description>
<group>web_scan,recon,</group>
</rule>
Where 30112 that is matched against is as follows:
<rule id="30112" level="2" overwrite="yes">
<if_sid>30101</if_sid>
<match>File does not exist: |</match>
<match>failed to open stream: No such file or directory|</match>
<match>Failed opening </match>
<description>Attempt to access an non-existent file.</description>
<group>unknown_resource,</group>
</rule>
Now, the above local_rules.xml overwrite works, and the 30114 which is
after the 30112 in terms of sequential / linear order used to work.
Do you know why ossec 2.3 cannot handle 30114 now?
Thank you.
