On Wed, 26 Jan 2011 08:22:39 -0800 (PST), Alessandro Di Giuseppe
<[email protected]> wrote:
Hi all,
Has anyone implemented any kind of custom check where OSSEC validates
whether a
host has outbound connectivity to a specific IP or to the Internet?
This would be useful to us, as we have some hosts which should *not*
have
Internet access, and we would like to have OSSEC check for this so we
can
validate for policy compliance.
I have done something similar when I wanted to know who wasn't
configured to go through the proxy. What I did was to write one rule at
level 0 which looked at the dstip of the proxy, so this would match
anyone who was configured. Then I wrote a child rule of that one to
catch the rest. This was awhile ago. I think now this can probably be
accomplished with something like <dstip>!172.16.0.2</dstip> (if that was
a proxy).
--
Michael Starks
[I] Immutable Security
http://www.immutablesecurity.com
