I think you would be better off using the full_command functionality. http://www.ossec.net/doc/manual/monitoring/process-monitoring.html
You just need to figure out a command that will display any Internet connections. Should be able to do it with netstat and some fancy parsing. ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Alessandro Di Giuseppe Sent: Wednesday, January 26, 2011 8:23 AM To: [email protected] Subject: [ossec-list] OSSEC Check for Outbound Network Connectivity Hi all, Has anyone implemented any kind of custom check where OSSEC validates whether a host has outbound connectivity to a specific IP or to the Internet? This would be useful to us, as we have some hosts which should *not* have Internet access, and we would like to have OSSEC check for this so we can validate for policy compliance. I'm not sure how to do this, but was thinking that it might be possible leveraging OSSEC's Active Response functionality to run a script testing web access, e.g. wget to google.com. Thanks, Alessandro
