ehlo *, I have an important question about CDB lists, as I'm just researching for my thesis on OSSEC. yes, i've read the documentation on readthedocs, maybe i'm too daft to understand it.
what I have done so far: I've created a file called "baddomains" in /var/ossec/lists/ content is from zeustracker (https://zeustracker.abuse.ch/blocklist.php?download=baddomains) I've added the list in the <rules></rules> section <list>lists/baddomains</list> i've run # bin/ossec-makelists i'm not quite sure what the purpose of the CDB lists is.... should a rule fire as soon as one of those domains (content of baddomains) is attacking me?! I don't think i've yet understood the positive/negative key match of it can someone please explain it to me with a real-life example? also what does CDB stand for? I haven't found that in the OSSEC Docs either.... common database? central database?! thanks, theresa -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
