I'm having trouble getting the active response agent on windows to work. I
can manually trigger the win_nullroute command by using "./agent_control -b
2.3.4.5 -f win_nullroute600 -u 010" on the ossec server, and the route
appears on the agent host, however none of the rules are firing on any
windows hosts.
I have email alerts set up so I know when the AR should activate, e.g.
Rule: 18152 fired (level 10) -> "Multiple Windows Logon Failures."
However, nothing appears in the logs on either the server or agent.
In server ossec.conf:
<command>
<name>win_nullroute</name>
<executable>route-null.cmd</executable>
<expect>srcip</expect>
<timeout_allowed>yes</timeout_allowed>
</command>
...
<active-response>
<command>win_nullroute</command>
<location>local</location>
<level>6</level>
<timeout>600</timeout>
</active-response>
In the agent ossec.conf:
<active-response>
<disabled>no</disabled>
</active-response>
Agent ar.conf:
restart-ossec0 - restart-ossec.cmd - 0
win_nullroute600 - route-null.cmd - 600
I also wanted to point out that the ar.conf file was never created
automatically on any of my windows hosts, not sure if that is normal or not.
Is there something that I am missing that needs to be configured that is not in
the documentation on http://www.ossec.net/doc/manual/ar/ar-windows.html?
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
