1. Check if the alert level is high enough to trigger active response ->
check rule alert level and compare /var/ossec/etc/ossec.conf for the minimum
alert level to trigger an active response (i think default is level="7" or
"6")
If the level of the rule is too low, you have 3 options.
a) make a trigger for an AR for the specific rule in your ossec.conf:
<active-response>
<!-- Firewall Drop response. Block the IP for
- 600 seconds on the firewall (iptables,
- ipfilter, etc).
-->
<command>firewall-drop</command>
<location>local</location>
<rules_id>{Rule id without quotation marks}</rules_id>
<timeout>600</timeout>
</active-response>
b) set the alert level of the rule higher (not recommended) to fit the
minimum alert level for AR, e.g. level="9"
c) copy the rule from the default rule file in /var/ossec/rules/ to your
/var/ossec/rules/local_rules.xml, add an overwrite="yes" and increase the
alert level there (e.g. level="9") in the <rule.. > section:
<rule id={the rule id WITH quotes} level="9" overwrite="yes"> as first line
of your rule definition
Then restart ossec.
2. Run the part of the logfile through /var/ossec/bin/ossec-logtest, check
if there is a srcip decoded. If there isn't you need to write a decoder,
i.e. adding a section in /var/ossec/etc/decoders.xml that matches your log
format, see http://www.madirish.net/?article=434 and have a look at
http://www.ossec.net/wiki/Know_How:Regex_Readme as well as
http://www.ossec.net/wiki/Decoder_rules_relation
Test the decoder by running your logs through ossec-logtest.
As soon as you got your decoder decoding the srcip right: Restart ossec.
Of course active response has to be enabled on your install.
Kind regards,
oscar
On Mon, Dec 14, 2009 at 6:08 PM, Peter M. Abraham <
[email protected]> wrote:
> Greetings:
>
> Given the following alert...
>
> Dec 13 23:07:24 web2 suhosin[18198]: ALERT - script tried to increase
> memory_limit to 134217728 bytes which is above the allowed value
> (attacker '[IP ADDRESS OF ALLEGED ATTACKER]', file '[full path to file
> goes here]', line 65)
>
>
> ... if this rule was tied to an active response "as is" would ossec
> know to block the [IP ADDRESS OF ALLEGED ATTACKER]?
>
> If not, what modifications would I have to make?
>
> Thank you.
>
