On 10/27/2010 01:30 PM, Steven Stern wrote: > Thanks. I've changed it and will await the next attack. > > On Wed, Oct 27, 2010 at 1:15 PM, jplee3 <[email protected]> wrote: >> Your <command> section looks OK. There may be issues with the <active- >> response> portion however. Try this: >> >> <active-response> >> <disabled>no</disabled> >> <command>firewall-drop</command> >> <location>local</location> >> <rules_id>31151</rules_id> >> <level>8</level> (I don't think you even need this flag if you >> *only* want to trigger on the rule id 31151) >> </active-response> >> >> >> Let us know if that works. I think it might be the "disabled" flag >> that was keeping it back. >> >> >> On Oct 27, 10:44 am, Steven Stern <[email protected]> >> wrote: >>> In /var/ossec/etc/osse.conf, I have >>> >>> <command> >>> <name>firewall-drop</name> >>> <executable>firewall-drop.sh</executable> >>> <expect>srcip</expect> >>> <timeout_allowed>yes</timeout_allowed> >>> </command> >>> >>> <active-response> >>> <command>firewall-drop</command> >>> <location>local</location> >>> <rules_id>31151</rules_id> >>> <level>8</level> >>> </active-response> >>> >>> My logs show multiple 31151 alerts. For example: >>> ossec-alerts-23.log:Rule: 31151 (level 10) -> 'Mutiple web server 400 >>> error codes from same source ip.' >>> ossec-alerts-25.log:Rule: 31151 (level 10) -> 'Mutiple web server 400 >>> error codes from same source ip.' >>> >>> As far as I can tell, the active response has never been triggered. >>> There's no active-response log in /var/ossec/logs and no logging of >>> firewall changes. >>> >>> What am I missing? >>
That ws it. Thanks. I had another attack and the rule fired. Here's the current ossec.conf: <command> <name>firewall-drop</name> <executable>firewall-drop.sh</executable> <expect>srcip</expect> <timeout_allowed>yes</timeout_allowed> </command> <active-response> <disabled>no</disabled> <command>firewall-drop</command> <location>local</location> <rules_id>31151,31152,31153</rules_id> </active-response> And this was in the logs # more active-responses.log Sat Oct 30 17:01:56 CDT 2010 /var/ossec/active-response/bin/firewall-drop.sh add - 210.21.221.156 1288476115.25429 31151 -- -- Steve
