Hello, I want to implement this policy on our servers: - Send an alert when a file is modified and when a file is added on specifics folders. - Don't send an alert while patching. (compromission risk while patching is very low)
I've read Michael Starks prestation at OSSEC CON 2013. Slide 49 : A quick and easy way not to get flooded with syscheck alerts just prior to patching your system is to clear the syscheck database You'll lose the ability to report on modified files using agent control, but previous alerts won't be affected ./bin/syscheck_control -u <agent ID> I've been testing this solution: I don't have alerts while patching, but I received alerts after 1 hour (through "new file in the folders" rule). How do you avoid this problem ? Best Regards -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
