Correct, the rules go on the server.
On Wed, Aug 4, 2010 at 7:29 AM, rafael.gomes <[email protected]> wrote: > Guys, > > Sorry for get this older mail, but I have another doubt. > > I need put it in /var/ossec/rules/local_rules.xml on the ossec server, > right? > > Atenciosamente, > > Rafael Brito Gomes > Analista de Segurança > LPIC-1 MCSO > DISUP/CPD/UFBA > Tel : +55 71 3283 6100 > > Em 01-10-2009 12:02, McClinton, Rick escreveu: >> >> <rule id="130101" level="12"> <!-- any id over 10000, a high level to >> trigger alerting --> >> <if_sid>30101</if_sid> <!-- if it has matched 30101, as >> demonstrated by ddp in other email --> >> <match>WEB_ATTACK</match> <!-- string in your log message --> >> <description>apache error tagged by modsecurity</description> >> <group>automatic_attack,</group> <!-- or other groups as appropriate --> >> </rule> >
