Ok, For the permission it does not work because Ossec supports only Possix permissions .
For registry I haven't been able to get an alert too. For example Ossec does not alert on new entries under HKEY/Software\Microsoft \Windows\CurrentVersion\Run which makes monitoring this key in ossec.conf pretty much useless . Cheers On Dec 12, 3:58 pm, alsdks <[email protected]> wrote: > Hello Nick, > > I have this rule set up to overwrite 554 but had it monitoring a > specific path . I am testing now to include monitoring the registry > key as well . > > However the ftp.exe example should be working as is ...I changed the > permission and should have been alerted. > THis however doesn't work ...I checked also with other examples > specified in default ossec.conf but still nothing ...And the strange > part is it did not get anything , not even an entry with logall > enabled ! > > Thank you > > On Dec 9, 3:46 pm, Nick Green <[email protected]> wrote: > > > > > > > > > Check your ossec.conf for alert_new_files options > > (http://www.ossec.net/main/manual/manual-syscheck) > > > Also check this rule in ossec_rules.xml > > > <rule id="554" level="0"> > > <category>ossec</category> > > <decoded_as>syscheck_new_entry</decoded_as> > > <description>File added to the system.</description> > > <group>syscheck,</group> > > </rule> > > > I bump up the level to 7 to make sure it fires off. > > > I'm not sure about the registry stuff ... only using on Linux atm > > > On Fri, Dec 9, 2011 at 12:46 PM, alsdks <[email protected]> wrote: > > > Hello all, > > > > I am testing syscheck default configuration on Windows platfroms. I > > > change a registry key by putting new entries under it > > > (HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run) and > > > also an executable located under System32 (say ftp.exe by changing its > > > permissions). > > > > For the registry change I got one alert out of three at least I should > > > be getting (after each change I restart syscheck to check again ) and > > > for the executable I did not receive anything at anytime .I also > > > checked logall archives.log for finding if any message for them > > > arrived but nothing. > > > > The above have been tested at two different Ossec servers and > > > environments both with the default out of box ossec.conf for Windows. > > > > Is there another setting I need to tweak for this ? > > > > Has anyone tested this ? > > > > Thank you > > > BR
