Hello, I added this rule to mu local_rules.xml file. Now how do I get it to work with the Windows agent?
I tried loggining into the server, I did not receive any email regarding a user logging in to this server. This is my first time addind a rule, so any help would be great. Thanks, Mike On Sat, Nov 20, 2010 at 2:00 PM, Jason 'XenoPhage' Frisvold < [email protected]> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Nov 20, 2010, at 1:49 AM, Mike Smith wrote: > > Hello, > > > > Is there any way that I can have OSSEC, alert each time a user logs > > into a computer, and not the first time, like the default action. > > > > Because I think this is a great feature and would like to get it to > > work all of the time and not just the first time. So if I wanted to > > add this feature, where would I configure it. > > Untested, but if you add this to local_rules.xml and restart the server, > this should do it : > > <rule id="10100" level="4" overwrite="yes"> > <if_group>authentication_success</if_group> > <options>alert_by_email</options> > <group>authentication_success</group> > <description>User logged in.</description> > </rule> > > > > Thanks, > > > > -M > > > > - --------------------------- > Jason 'XenoPhage' Frisvold > [email protected] > - --------------------------- > "Any sufficiently advanced magic is indistinguishable from technology." > - - Niven's Inverse of Clarke's Third Law > > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.14 (Darwin) > > iEYEARECAAYFAkzoNtYACgkQ8CjzPZyTUTRRcgCeKaG8uAXVy6pAyGk9ghvWJr5g > AzYAnjUXS51xY5T5dzCXbVjECkF9TjJw > =B/4U > -----END PGP SIGNATURE----- >
