Ahh, I think I've now got it :) also found a very good example that showcases it better.
silly me ;) Am Freitag, 18. März 2016 20:45:31 UTC+1 schrieb Eero Volotinen: > > Err. You must be joking? Try googling with 'CDB'. > > Eero > 18.3.2016 9.42 ip. "theresa mic-snare" <[email protected] <javascript:>> > kirjoitti: > >> ehlo *, >> >> I have an important question about CDB lists, as I'm just researching for >> my thesis on OSSEC. >> yes, i've read the documentation on readthedocs, maybe i'm too daft to >> understand it. >> >> what I have done so far: >> >> I've created a file called "baddomains" in /var/ossec/lists/ >> content is from zeustracker ( >> https://zeustracker.abuse.ch/blocklist.php?download=baddomains) >> >> I've added the list in the <rules></rules> section >> <list>lists/baddomains</list> >> >> i've run >> # bin/ossec-makelists >> >> >> i'm not quite sure what the purpose of the CDB lists is.... should a rule >> fire as soon as one of those domains (content of baddomains) is attacking >> me?! >> I don't think i've yet understood the positive/negative key match of it >> >> can someone please explain it to me with a real-life example? >> >> also what does CDB stand for? I haven't found that in the OSSEC Docs >> either.... >> common database? central database?! >> >> thanks, >> theresa >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> For more options, visit https://groups.google.com/d/optout. >> > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
