On Thu, Jun 6, 2013 at 2:08 PM, Andrew Sarver <[email protected]> wrote: > The active-response.log on the agents only shows the responses I manually > executed, e.g. 06/06/2013 10:48 "active-response/bin/route-null.cmd" add > "-" "2.3.4.5" "(from_the_server) (no_rule_id)" >
Make sure the rules you are expected to trigger this AR actually decode an IP address to nullroute. Other than that, no real ideas. You could try tracking down the issue you had with ar.conf to see if that helps. > On Thursday, June 6, 2013 1:10:15 PM UTC-4, dan (ddpbsd) wrote: >> >> On Thu, Jun 6, 2013 at 1:02 PM, Andrew Sarver <[email protected]> wrote: >> > Dan, >> > >> > It seems like only the default active response scripts are being >> > recognized. >> > In the ossec.log on the agent system, I have these three lines from >> > testing >> > earlier today: >> > >> > 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not >> > present: >> > 'active-response/bin/restart-ossec.sh'. Not using it on this system. >> > >> > 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not >> > present: >> > 'active-response/bin/host-deny.sh'. Not using it on this system. >> > >> > 2013/06/06 12:03:27 ossec-agent: INFO: Active response command not >> > present: >> > 'active-response/bin/firewall-drop.sh'. Not using it on this system. >> > >> > This has only been logged once and I have been testing numerous times >> > over >> > the past few hours. >> > >> >> >> I'm not sure why it's looking for those, they're obviously useless on >> a windows system. >> >> > From the ossec server: >> > ./agent_control -L >> > >> > OSSEC HIDS agent_control. Available active responses: >> > >> > Response name: host-deny600, command: host-deny.sh >> > Response name: firewall-drop600, command: firewall-drop.sh >> > Response name: win_nullroute600, command: route-null.cmd >> > >> > The only scripts I have in the active-response/bin folder on the agent >> > are >> > restart-ossec.cmd and route-null.cmd. The active-responses.log file on >> > the >> > management server is empty. >> > >> >> Did you check the active-responses.log on the agents? That is where >> you want to run the AR blocks right? >> >> > >> > >> > On Thursday, June 6, 2013 10:48:55 AM UTC-4, dan (ddpbsd) wrote: >> >> >> >> On Thu, Jun 6, 2013 at 9:04 AM, Andrew Sarver <[email protected]> >> >> wrote: >> >> > I'm having trouble getting the active response agent on windows to >> >> > work. >> >> > I >> >> > can manually trigger the win_nullroute command by using >> >> > "./agent_control >> >> > -b >> >> > 2.3.4.5 -f win_nullroute600 -u 010" on the ossec server, and the >> >> > route >> >> > appears on the agent host, however none of the rules are firing on >> >> > any >> >> > windows hosts. >> >> > >> >> > I have email alerts set up so I know when the AR should activate, >> >> > e.g. >> >> > >> >> > Rule: 18152 fired (level 10) -> "Multiple Windows Logon Failures." >> >> > However, nothing appears in the logs on either the server or agent. >> >> > >> >> >> >> Which logs are you checking? Based on the configuration below, I >> >> believe the AR should only happen on the agent that created the log >> >> message. >> >> >> >> I don't have any Windows systems to test with, but is anything >> >> mentioned about active response in the ossec.log on the agents? >> >> >> >> > In server ossec.conf: >> >> > <command> >> >> > <name>win_nullroute</name> >> >> > <executable>route-null.cmd</executable> >> >> > <expect>srcip</expect> >> >> > <timeout_allowed>yes</timeout_allowed> >> >> > </command> >> >> > ... >> >> > <active-response> >> >> > <command>win_nullroute</command> >> >> > <location>local</location> >> >> > <level>6</level> >> >> > <timeout>600</timeout> >> >> > </active-response> >> >> > >> >> > >> >> > In the agent ossec.conf: >> >> > <active-response> >> >> > <disabled>no</disabled> >> >> > </active-response> >> >> > >> >> > Agent ar.conf: >> >> > >> >> > restart-ossec0 - restart-ossec.cmd - 0 >> >> > win_nullroute600 - route-null.cmd - 600 >> >> > >> >> > I also wanted to point out that the ar.conf file was never created >> >> > automatically on any of my windows hosts, not sure if that is normal >> >> > or >> >> > not. >> >> > >> >> >> >> This is not normal. >> >> >> >> > Is there something that I am missing that needs to be configured that >> >> > is >> >> > not >> >> > in the documentation on >> >> > http://www.ossec.net/doc/manual/ar/ar-windows.html? >> >> > >> >> > -- >> >> > >> >> > --- >> >> > You received this message because you are subscribed to the Google >> >> > Groups >> >> > "ossec-list" group. >> >> > To unsubscribe from this group and stop receiving emails from it, >> >> > send >> >> > an >> >> > email to [email protected]. >> >> > For more options, visit https://groups.google.com/groups/opt_out. >> >> > >> >> > >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/groups/opt_out. >> > >> > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
