On Fri, Dec 9, 2011 at 10:16 PM, Chris Decker <[email protected]> wrote: > All, > > I'm been looking at the OSSEC documentation and can't get my head > around how to utilize the CDB feature. > > I was hoping to create a mapping of the authorized usernames for each > IP/host. Upon a sid related to login, I want to verify the user is > authorized for that IP. If not, I want to generate an alert. > > As I mentioned, I've read the OSSEC documentation but still can't > figure things out. I've also read the past OSSEC User Group postings. > > Can someone post a brief example of a setup that does something > similar to what I need so I have a model for implementing this? > > > > Thanks, > Chris > > > Sent from my iPhone
There isn't really a way to search a cdb for multiple fields, which is what I think you'd need to do if you only used 1 list. You could create 1 list per system, which would necessitate 1 rule/system as well.
