Guys, Sorry for get this older mail, but I have another doubt.
I need put it in /var/ossec/rules/local_rules.xml on the ossec server, right?
Atenciosamente, Rafael Brito Gomes Analista de Segurança LPIC-1 MCSO DISUP/CPD/UFBA Tel : +55 71 3283 6100 Em 01-10-2009 12:02, McClinton, Rick escreveu:
<rule id="130101" level="12"> <!-- any id over 10000, a high level to trigger alerting --> <if_sid>30101</if_sid> <!-- if it has matched 30101, as demonstrated by ddp in other email --> <match>WEB_ATTACK</match> <!-- string in your log message --> <description>apache error tagged by modsecurity</description> <group>automatic_attack,</group> <!-- or other groups as appropriate --> </rule>
