Not through OSSEC by default. That's best handled by your configuration management process.
However, if you want to do something like this it shouldn't be too hard to do. "echo 'host: 192.168.1.1' | logger -t blockscript" Then setup a decoder like the following (all of this is untested so do your homework before putting it into production): <decoder name="blockscript"> <program_name>blockscript</program_name> <regex>host: (\S+)$</regex> <order>srcip</order> </decoder> And a rule: <rule id="100900" level="10"> <decoded_as>blockscript</decoded_as> <description>Someone ran the blockscript!</description> </rule> And then setup an AR for rule id 100900 to be run on all agents. On Tue, Nov 2, 2010 at 4:56 PM, Chris <[email protected]> wrote: > Is there a way to use firewall-drop.sh by hand to block a ip on all clients? >
