On Thu, Jun 6, 2013 at 1:02 PM, Andrew Sarver <[email protected]> wrote: > Dan, > > It seems like only the default active response scripts are being recognized. > In the ossec.log on the agent system, I have these three lines from testing > earlier today: > > 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not present: > 'active-response/bin/restart-ossec.sh'. Not using it on this system. > > 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not present: > 'active-response/bin/host-deny.sh'. Not using it on this system. > > 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not present: > 'active-response/bin/firewall-drop.sh'. Not using it on this system. > > This has only been logged once and I have been testing numerous times over > the past few hours. >
I'm not sure why it's looking for those, they're obviously useless on a windows system. > From the ossec server: > ./agent_control -L > > OSSEC HIDS agent_control. Available active responses: > > Response name: host-deny600, command: host-deny.sh > Response name: firewall-drop600, command: firewall-drop.sh > Response name: win_nullroute600, command: route-null.cmd > > The only scripts I have in the active-response/bin folder on the agent are > restart-ossec.cmd and route-null.cmd. The active-responses.log file on the > management server is empty. > Did you check the active-responses.log on the agents? That is where you want to run the AR blocks right? > > > On Thursday, June 6, 2013 10:48:55 AM UTC-4, dan (ddpbsd) wrote: >> >> On Thu, Jun 6, 2013 at 9:04 AM, Andrew Sarver <[email protected]> wrote: >> > I'm having trouble getting the active response agent on windows to work. >> > I >> > can manually trigger the win_nullroute command by using "./agent_control >> > -b >> > 2.3.4.5 -f win_nullroute600 -u 010" on the ossec server, and the route >> > appears on the agent host, however none of the rules are firing on any >> > windows hosts. >> > >> > I have email alerts set up so I know when the AR should activate, e.g. >> > >> > Rule: 18152 fired (level 10) -> "Multiple Windows Logon Failures." >> > However, nothing appears in the logs on either the server or agent. >> > >> >> Which logs are you checking? Based on the configuration below, I >> believe the AR should only happen on the agent that created the log >> message. >> >> I don't have any Windows systems to test with, but is anything >> mentioned about active response in the ossec.log on the agents? >> >> > In server ossec.conf: >> > <command> >> > <name>win_nullroute</name> >> > <executable>route-null.cmd</executable> >> > <expect>srcip</expect> >> > <timeout_allowed>yes</timeout_allowed> >> > </command> >> > ... >> > <active-response> >> > <command>win_nullroute</command> >> > <location>local</location> >> > <level>6</level> >> > <timeout>600</timeout> >> > </active-response> >> > >> > >> > In the agent ossec.conf: >> > <active-response> >> > <disabled>no</disabled> >> > </active-response> >> > >> > Agent ar.conf: >> > >> > restart-ossec0 - restart-ossec.cmd - 0 >> > win_nullroute600 - route-null.cmd - 600 >> > >> > I also wanted to point out that the ar.conf file was never created >> > automatically on any of my windows hosts, not sure if that is normal or >> > not. >> > >> >> This is not normal. >> >> > Is there something that I am missing that needs to be configured that is >> > not >> > in the documentation on >> > http://www.ossec.net/doc/manual/ar/ar-windows.html? >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/groups/opt_out. >> > >> > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
