Hi, can you help me with a problem?
I have a ossec-wazuh Server with 20 agents connected with active response
for agent id 001.
Ossec.conf ------- the server
<active-response>
<! - Block rule level 8 agent 001 ->
<command> firewall-drop </ command>
<location> defined-agent </ location>
<agent_id> 001 </ agent_id>
<level> 8 </ level>
<timeout> 600 </ timeout>
</ active-response>
/var/ossec/etc/shared/agent.conf ---------the server (To see the blocking
alerts in the
kibana) https://blog.wazuh.com/blocking-attacks-active-response/
<agent_config name = "xxxxxxxxxxx">
<localfile>
<log_format> syslog </ log_format>
<location> /var/ossec/logs/active-responses.log </ location>
</ localfile>
</ agent_config>
When an alert level > 8 is generated in another agent, the firewall-drop of
agent 001 blocks the ip. But that IP has not sent any request to agent 001.
Thank you
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
