On Mon, Oct 21, 2013 at 10:00 AM, Kaspars Līcis <[email protected]> wrote: > Hello, I am trying to create rule that alerts if someone accessed to > specific folder in wondows server. > Issue is that if I write- <match>E:\\HOMES\\HOME02\\secret</match> ossec > don't detect it > > path is E:\HOMES\HOME02\secret >
Did you try just using the path? > If I write <match>secret</match> it is working. Is it way how to define full > path? > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
