I think you would be better off using the full_command functionality.

http://www.ossec.net/doc/manual/monitoring/process-monitoring.html

You just need to figure out a command that will display any Internet 
connections.  Should be able to do it with netstat and some fancy parsing.

________________________________
From: [email protected] [mailto:[email protected]] On 
Behalf Of Alessandro Di Giuseppe
Sent: Wednesday, January 26, 2011 8:23 AM
To: [email protected]
Subject: [ossec-list] OSSEC Check for Outbound Network Connectivity

Hi all,

Has anyone implemented any kind of custom check where OSSEC validates whether a 
host has outbound connectivity to a specific IP or to the Internet?

This would be useful to us, as we have some hosts which should *not* have 
Internet access, and we would like to have OSSEC check for this so we can 
validate for policy compliance.

I'm not sure how to do this, but was thinking that it might be possible 
leveraging OSSEC's Active Response functionality to run a script testing web 
access, e.g. wget to google.com.

Thanks,

Alessandro

Reply via email to