Hi,
With the default configuration, when a rootcheck audit check fails,
rule 516 is triggered. I wanted to give a different alert level to
some audit checks, for example when a user other than root has uid 0.
To do so, I created this rule :
<rule id="100010" level="14">
<if_sid>516</if_sid>
<match>Non-root account with uid 0</match>
<description>Non-root account with uid 0</description>
</rule>
To test it, I had request a rootcheck with agent control. However,
creating the rule took me a couple of attempts (due to the fact that I
didn't work with ossec for a while) and it was taking about 5-10 mins
between each rootcheck, plus the time for the rootcheck to complete. I
would like to be able to test the rule with ossec-logtest, but the
parent rule of 516 relies on the ossec decoder. I tried "reversing" it
by reading the code of the ossecalert decoder plugin without success.
So my question is this. Is there any reference on the format of
internal messaging of ossec ? Would it work with ossec-logtest ?
Also, it might make things easier to assign alert levels directly in
the RCL audit files.
Thanks!
Sébastien
