On Tue, Jul 15, 2014 at 12:21 PM, Blitzou44 <[email protected]> wrote:
> Hello, > I want to implement this policy on our servers: > - Send an alert when a file is modified and when a file is added on > specifics folders. > - Don't send an alert while patching. (compromission risk while patching > is very low) > > I've read Michael Starks prestation at OSSEC CON 2013. > Slide 49 : > A quick and easy way not to get flooded with syscheck alerts just prior to > patching your system is to clear the syscheck database > You'll lose the ability to report on modified files using agent control, > but previous alerts won't be affected > ./bin/syscheck_control -u <agent ID> > > I've been testing this solution: I don't have alerts while patching, but I > received alerts after 1 hour (through "new file in the folders" rule). > > How do you avoid this problem ? > I've actually just finished up some work to address this problem in our environment. In a nutshell, I'm abusing active response to verify files that trigger integrity checksum and new file rules (550-552, 554). I've redefined the standard integrity changed/new file rules to reduce the severity, so emails won't be sent out. When tripping any of these new rules, I've got active response configured to run a file verification script. The script identifies the file that changed, verifies it against the local dpkg/yum database, and if the verification succeeds, doesn't raise an alert. If the verification fails, or if the file meets any other set of static criteria we've defined, it raises an alert. This allows us to run syscheck live, without clearing the database, and not be notified of proper system patching. It is, however, an abuse of active response, and there are a few caveats with it. The biggest being that when OSSEC runs an active response, it's fire-and-forget; ideally, if the active response script failed (i.e. returns !0), OSSEC would raise an email alert itself. Since that's not the case, we have to be extra careful that our script fails in a clean and predictable way, every time, which is tricky. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
