<rule id="700086" level="7">
<if_sid>530</if_sid>
<match>ossec: output: 'for /f "tokens=3*"</match>
<check_diff />
<description>new soft install</description>
</rule>
<localfile>
<log_format>full_command</log_format>
<frequency>10</frequency>
<command>for /f "tokens=3*" %a in ('reg query
"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" /s ^| find /i
"DisplayName"') do @echo %a%b</command>
</localfile>
but is only a single file in the directory /var/ossec/queue/diff/tes
/700086/ only one file 'last-entry' , not what it Compare the. How to get
files like "state.1412050724" for example.
понедельник, 9 февраля 2015 г., 16:08:11 UTC+3 пользователь dan (ddpbsd)
написал:
>
> On Mon, Feb 9, 2015 at 6:07 AM, alex petrov <[email protected]
> <javascript:>> wrote:
> > Help please. Why when I use the chesk_diff I have created in the
> directory
> > /var/ossec/queue/diff/tes /700086/ only one file 'last-entry' instead of
> > multiple files with changes.
> >
>
> Are all of these files text files?
> Has a syscheck scan been run since they were changed?
>
> > --
> >
> > ---
> > You received this message because you are subscribed to the Google
> Groups
> > "ossec-list" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> an
> > email to [email protected] <javascript:>.
> > For more options, visit https://groups.google.com/d/optout.
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
