Dan, It seems like only the default active response scripts are being recognized. In the ossec.log on the agent system, I have these three lines from testing earlier today:
2013/06/06 12:03:27 ossec-agent: INFO: Active response command not present: 'active-response/bin/restart-ossec.sh'. Not using it on this system. 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not present: 'active-response/bin/host-deny.sh'. Not using it on this system. 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not present: 'active-response/bin/firewall-drop.sh'. Not using it on this system. This has only been logged once and I have been testing numerous times over the past few hours. >From the ossec server: ./agent_control -L OSSEC HIDS agent_control. Available active responses: Response name: host-deny600, command: host-deny.sh Response name: firewall-drop600, command: firewall-drop.sh Response name: win_nullroute600, command: route-null.cmd The only scripts I have in the active-response/bin folder on the agent are restart-ossec.cmd and route-null.cmd. The active-responses.log file on the management server is empty. On Thursday, June 6, 2013 10:48:55 AM UTC-4, dan (ddpbsd) wrote: > > On Thu, Jun 6, 2013 at 9:04 AM, Andrew Sarver > <[email protected]<javascript:>> > wrote: > > I'm having trouble getting the active response agent on windows to work. > I > > can manually trigger the win_nullroute command by using "./agent_control > -b > > 2.3.4.5 -f win_nullroute600 -u 010" on the ossec server, and the route > > appears on the agent host, however none of the rules are firing on any > > windows hosts. > > > > I have email alerts set up so I know when the AR should activate, e.g. > > > > Rule: 18152 fired (level 10) -> "Multiple Windows Logon Failures." > > However, nothing appears in the logs on either the server or agent. > > > > Which logs are you checking? Based on the configuration below, I > believe the AR should only happen on the agent that created the log > message. > > I don't have any Windows systems to test with, but is anything > mentioned about active response in the ossec.log on the agents? > > > In server ossec.conf: > > <command> > > <name>win_nullroute</name> > > <executable>route-null.cmd</executable> > > <expect>srcip</expect> > > <timeout_allowed>yes</timeout_allowed> > > </command> > > ... > > <active-response> > > <command>win_nullroute</command> > > <location>local</location> > > <level>6</level> > > <timeout>600</timeout> > > </active-response> > > > > > > In the agent ossec.conf: > > <active-response> > > <disabled>no</disabled> > > </active-response> > > > > Agent ar.conf: > > > > restart-ossec0 - restart-ossec.cmd - 0 > > win_nullroute600 - route-null.cmd - 600 > > > > I also wanted to point out that the ar.conf file was never created > > automatically on any of my windows hosts, not sure if that is normal or > not. > > > > This is not normal. > > > Is there something that I am missing that needs to be configured that is > not > > in the documentation on > http://www.ossec.net/doc/manual/ar/ar-windows.html? > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/groups/opt_out. > > > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
