On Tue, Nov 30, 2010 at 11:45 AM, Mike Smith <[email protected]> wrote: > Hello, > > I added this rule to mu local_rules.xml file. Now how do I get it to work > with the Windows agent? > > I tried loggining into the server, I did not receive any email regarding a > user logging in to this server. > > This is my first time addind a rule, so any help would be great. > > Thanks, > > Mike > > On Sat, Nov 20, 2010 at 2:00 PM, Jason 'XenoPhage' Frisvold > <[email protected]> wrote: >> >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> On Nov 20, 2010, at 1:49 AM, Mike Smith wrote: >> > Hello, >> > >> > Is there any way that I can have OSSEC, alert each time a user logs >> > into a computer, and not the first time, like the default action. >> > >> > Because I think this is a great feature and would like to get it to >> > work all of the time and not just the first time. So if I wanted to >> > add this feature, where would I configure it. >> >> Untested, but if you add this to local_rules.xml and restart the server, >> this should do it : >> >> <rule id="10100" level="4" overwrite="yes"> >> <if_group>authentication_success</if_group> >> <options>alert_by_email</options> >> <group>authentication_success</group> >> <description>User logged in.</description> >> </rule> >> >> >> > Thanks, >> > >> > -M >> >> >> >> - --------------------------- >> Jason 'XenoPhage' Frisvold >> [email protected] >> - --------------------------- >> "Any sufficiently advanced magic is indistinguishable from technology." >> - - Niven's Inverse of Clarke's Third Law >> >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: GnuPG/MacGPG2 v2.0.14 (Darwin) >> >> iEYEARECAAYFAkzoNtYACgkQ8CjzPZyTUTRRcgCeKaG8uAXVy6pAyGk9ghvWJr5g >> AzYAnjUXS51xY5T5dzCXbVjECkF9TjJw >> =B/4U >> -----END PGP SIGNATURE----- > >
Try adding the following to local_rules.xml and restarting the ossec processes on the manager: <rule id="100000" level="7"> <if_group>authentication_success</if_group> <options>alert_by_email</options> <description>User logged in.</description> </rule> If an event decodes to an authentication_success alert, then this should fire. If your login process does not create an authentication_success event, this will not fire. You'll have to find out what logs are crated when a user logs in, and make a custom rule for that (or overwrite it to fire off an email every time).
