On Thu, Jun 6, 2013 at 9:04 AM, Andrew Sarver <[email protected]> wrote: > I'm having trouble getting the active response agent on windows to work. I > can manually trigger the win_nullroute command by using "./agent_control -b > 2.3.4.5 -f win_nullroute600 -u 010" on the ossec server, and the route > appears on the agent host, however none of the rules are firing on any > windows hosts. > > I have email alerts set up so I know when the AR should activate, e.g. > > Rule: 18152 fired (level 10) -> "Multiple Windows Logon Failures." > However, nothing appears in the logs on either the server or agent. >
Which logs are you checking? Based on the configuration below, I believe the AR should only happen on the agent that created the log message. I don't have any Windows systems to test with, but is anything mentioned about active response in the ossec.log on the agents? > In server ossec.conf: > <command> > <name>win_nullroute</name> > <executable>route-null.cmd</executable> > <expect>srcip</expect> > <timeout_allowed>yes</timeout_allowed> > </command> > ... > <active-response> > <command>win_nullroute</command> > <location>local</location> > <level>6</level> > <timeout>600</timeout> > </active-response> > > > In the agent ossec.conf: > <active-response> > <disabled>no</disabled> > </active-response> > > Agent ar.conf: > > restart-ossec0 - restart-ossec.cmd - 0 > win_nullroute600 - route-null.cmd - 600 > > I also wanted to point out that the ar.conf file was never created > automatically on any of my windows hosts, not sure if that is normal or not. > This is not normal. > Is there something that I am missing that needs to be configured that is not > in the documentation on http://www.ossec.net/doc/manual/ar/ar-windows.html? > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
