Hi all, Has anyone implemented any kind of custom check where OSSEC validates whether a host has outbound connectivity to a specific IP or to the Internet?
This would be useful to us, as we have some hosts which should *not* have Internet access, and we would like to have OSSEC check for this so we can validate for policy compliance. I'm not sure how to do this, but was thinking that it might be possible leveraging OSSEC's Active Response functionality to run a script testing web access, e.g. wget to google.com. Thanks, Alessandro
