In an attempt to get email notifications to work with the newly built-
in active-response notification rules, I'm trying to override the
built in rules with ones in local_rules.xml that have the addition of
"<options>alert_by_email</options>". So far using ossec-logtest I'm
unable to get the custom rules to fire. Using OSSEC-2.6.0-Beta in
Linux
All the rules are identical to those built-in except I changed the
rule number to be greater than 100000 and added the "options" line.
(see below for full copy/paste).
Here's the process I'm going through,
# bin/ossec-control enable debug
# bin/ossec-control restart
2011/06/23 12:59:41 adding rule: local_rules.xml
....
# bin/ossec-logtest -d
...no errors...
2011/06/23 13:01:34 1 : rule:100000, level 0, timeout: 0
2011/06/23 13:01:34 2 : rule:100001, level 3, timeout: 0
2011/06/23 13:01:34 2 : rule:100002, level 3, timeout: 0
2011/06/23 13:01:34 2 : rule:100003, level 3, timeout: 0
2011/06/23 13:01:34 2 : rule:100004, level 3, timeout: 0
2011/06/23 13:01:34 2 : rule:100005, level 3, timeout: 0
2011/06/23 13:01:34 2 : rule:100006, level 3, timeout: 0
...
ossec-testrule: Type one log per line.
Thu Jun 23 05:08:10 CDT 2011 /var/ossec/active-response/bin/firewall-
drop.sh delete - 212.113.37.105 1308823060.107076 31151
**Phase 1: Completed pre-decoding.
full event: 'Thu Jun 23 05:08:10 CDT 2011 /var/ossec/active-
response/bin/firewall-drop.sh delete - 212.113.37.105
1308823060.107076 31151'
hostname: 'ossecserver'
program_name: '(null)'
log: 'Thu Jun 23 05:08:10 CDT 2011 /var/ossec/active-response/
bin/firewall-drop.sh delete - 212.113.37.105 1308823060.107076 31151'
**Phase 2: Completed decoding.
decoder: 'ar_log'
action: 'firewall-drop.sh'
status: 'delete'
srcip: '212.113.37.105'
id: '1308823060.107076'
extra_data: '31151'
**Phase 3: Completed filtering (rules).
Rule id: '602'
Level: '3'
Description: 'Host Unblocked by firewall-drop.sh Active
Response'
**Alert to be generated.
------------------
I tested all 6 rules and all 6 are not being overridden. Does OSSEC
load rules 600-606 before the local_rules.xml and thus it's not
possible to override? I've tried changing "<if_sid>" to 600, and also
removing rule 100000, then adding "decoded_as" to each of the rules
and removing "if_sid", but still the same result.
Here's the my entire local_rules.xml
<group name="local,syslog,">
<rule id="100000" level="0">
<decoded_as>ar_log</decoded_as>
<description>Active Response Messages Grouped</description>
<group>active_response,</group>
</rule>
<rule id="100001" level="3">
<if_sid>100000</if_sid>
<options>alert_by_email</options>
<action>firewall-drop.sh</action>
<status>add</status>
<description>Host Blocked by firewall-drop.sh Active Response</
description>
<group>active_response,</group>
</rule>
<rule id="100002" level="3">
<if_sid>100000</if_sid>
<options>alert_by_email</options>
<action>firewall-drop.sh</action>
<status>delete</status>
<description>Host Unblocked by firewall-drop.sh Active Response</
description>
<group>active_response,</group>
</rule>
<rule id="100003" level="3">
<if_sid>100000</if_sid>
<options>alert_by_email</options>
<action>host-deny.sh</action>
<status>add</status>
<description>Host Blocked by host-deny.sh Active Response</
description>
<group>active_response,</group>
</rule>
<rule id="100004" level="3">
<if_sid>100000</if_sid>
<options>alert_by_email</options>
<action>host-deny.sh</action>
<status>delete</status>
<description>Host Unblocked by host-deny.sh Active Response</
description>
<group>active_response,</group>
</rule>
<rule id="100005" level="3">
<if_sid>100000</if_sid>
<options>alert_by_email</options>
<action>route-null.sh</action>
<status>add</status>
<description>Host Blocked by route-null.sh Active Response</
description>
<group>active_response,</group>
</rule>
<rule id="100006" level="3">
<if_sid>100000</if_sid>
<options>alert_by_email</options>
<action>route-null.sh</action>
<status>delete</status>
<description>Host Unblocked by route-null.sh Active Response</
description>
<group>active_response,</group>
</rule>
</group>
Thanks
- Trey
