On 09/10/2012 08:52 PM, dan (ddp) wrote:
Why not create a rule to filter this out? <rule id="STUFF" level="0"> <if_sid>1002</if_sid> <decoded_as>custom-openbsd-pf</decoded_as> <match>bad cksum</match> <proto>udp</proto> <dstport>123</dstport> <description>Ignore this.</description> </rule> (This is totally untested, so I could have mistyped something or dstport may not be available, etc.)Thanks dan but I need to catch this "alert" as good. It can not be discarded.I don't understand? You need an alert that says this log message is ok? Change the description and level. If that is what you want, could you explain why you want it to alert on something "not bad?"
Ok, I will try to explain. I am receiving all logs from this OBSD firewall... I am logging all accepted connections. When fw accepts a connection, ossec agent send logs to server. In the server side, I check all these accepted connections with a blacklist cdb list. In my example, if this ntp public server is on this cdb list, alert is triggered, but if rule 1002 is triggered before, it is a problem ...
For this reason, I need to disable rule 1002 for this decoder/rules associated with logs received from this fw, because rule 1002 always will be a false possitive ...
--
CL Martinez
carlopmart {at} gmail {d0t} com
