The active-response.log on the agents only shows the responses I manually executed, e.g. 06/06/2013 10:48 "active-response/bin/route-null.cmd" add "-" "2.3.4.5" "(from_the_server) (no_rule_id)"
On Thursday, June 6, 2013 1:10:15 PM UTC-4, dan (ddpbsd) wrote: > > On Thu, Jun 6, 2013 at 1:02 PM, Andrew Sarver > <[email protected]<javascript:>> > wrote: > > Dan, > > > > It seems like only the default active response scripts are being > recognized. > > In the ossec.log on the agent system, I have these three lines from > testing > > earlier today: > > > > 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not > present: > > 'active-response/bin/restart-ossec.sh'. Not using it on this system. > > > > 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not > present: > > 'active-response/bin/host-deny.sh'. Not using it on this system. > > > > 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not > present: > > 'active-response/bin/firewall-drop.sh'. Not using it on this system. > > > > This has only been logged once and I have been testing numerous times > over > > the past few hours. > > > > > I'm not sure why it's looking for those, they're obviously useless on > a windows system. > > > From the ossec server: > > ./agent_control -L > > > > OSSEC HIDS agent_control. Available active responses: > > > > Response name: host-deny600, command: host-deny.sh > > Response name: firewall-drop600, command: firewall-drop.sh > > Response name: win_nullroute600, command: route-null.cmd > > > > The only scripts I have in the active-response/bin folder on the agent > are > > restart-ossec.cmd and route-null.cmd. The active-responses.log file on > the > > management server is empty. > > > > Did you check the active-responses.log on the agents? That is where > you want to run the AR blocks right? > > > > > > > On Thursday, June 6, 2013 10:48:55 AM UTC-4, dan (ddpbsd) wrote: > >> > >> On Thu, Jun 6, 2013 at 9:04 AM, Andrew Sarver <[email protected]> > wrote: > >> > I'm having trouble getting the active response agent on windows to > work. > >> > I > >> > can manually trigger the win_nullroute command by using > "./agent_control > >> > -b > >> > 2.3.4.5 -f win_nullroute600 -u 010" on the ossec server, and the > route > >> > appears on the agent host, however none of the rules are firing on > any > >> > windows hosts. > >> > > >> > I have email alerts set up so I know when the AR should activate, > e.g. > >> > > >> > Rule: 18152 fired (level 10) -> "Multiple Windows Logon Failures." > >> > However, nothing appears in the logs on either the server or agent. > >> > > >> > >> Which logs are you checking? Based on the configuration below, I > >> believe the AR should only happen on the agent that created the log > >> message. > >> > >> I don't have any Windows systems to test with, but is anything > >> mentioned about active response in the ossec.log on the agents? > >> > >> > In server ossec.conf: > >> > <command> > >> > <name>win_nullroute</name> > >> > <executable>route-null.cmd</executable> > >> > <expect>srcip</expect> > >> > <timeout_allowed>yes</timeout_allowed> > >> > </command> > >> > ... > >> > <active-response> > >> > <command>win_nullroute</command> > >> > <location>local</location> > >> > <level>6</level> > >> > <timeout>600</timeout> > >> > </active-response> > >> > > >> > > >> > In the agent ossec.conf: > >> > <active-response> > >> > <disabled>no</disabled> > >> > </active-response> > >> > > >> > Agent ar.conf: > >> > > >> > restart-ossec0 - restart-ossec.cmd - 0 > >> > win_nullroute600 - route-null.cmd - 600 > >> > > >> > I also wanted to point out that the ar.conf file was never created > >> > automatically on any of my windows hosts, not sure if that is normal > or > >> > not. > >> > > >> > >> This is not normal. > >> > >> > Is there something that I am missing that needs to be configured that > is > >> > not > >> > in the documentation on > >> > http://www.ossec.net/doc/manual/ar/ar-windows.html? > >> > > >> > -- > >> > > >> > --- > >> > You received this message because you are subscribed to the Google > >> > Groups > >> > "ossec-list" group. > >> > To unsubscribe from this group and stop receiving emails from it, > send > >> > an > >> > email to [email protected]. > >> > For more options, visit https://groups.google.com/groups/opt_out. > >> > > >> > > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/groups/opt_out. > > > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
