Hi!
I'm trying to put dstip in ossec too, but into active-response to work
with snort, but I did not know quite what to do.
if anyone has a solution, it would be welcome
Att,
Guilherme
Em 14-12-2010 22:48, jplee3 escreveu:
Hi all,
Is there a way to pass the decoder order variable "dstip" (as well as
anything else like "extra_data", etc, to Active Response?
I have the following command setup in my ossec.conf:
<command>
<name>testing<name>
<executable>testing.sh</executable>
<expect>srcip, dstip</expect>
</command>
The testing.sh AR script contains the following
#!/bin/sh
echo $@>> /tmp/testing
So anything and everything getting passed to AR should get spit out
into /tmp/testing.
However, when I look at /tmp/testing I do not see the dstip that I
have setup in the decoder. I do see the srcip however.
Is there a way to get the dstip to show in the output?
