On Fri, Nov 10, 2017 at 3:00 PM, Josmell Chavarri <[email protected]> wrote: > Hi, can you help me with a problem? > > I have a ossec-wazuh Server with 20 agents connected with active response > for agent id 001. >
This is the OSSEC mailing list, not the Wazuh list. Perhaps they would be better equipped to help you with their product? > > Ossec.conf ------- the server > > <active-response> > <! - Block rule level 8 agent 001 -> > <command> firewall-drop </ command> > <location> defined-agent </ location> > <agent_id> 001 </ agent_id> > <level> 8 </ level> > <timeout> 600 </ timeout> > </ active-response> > > > /var/ossec/etc/shared/agent.conf ---------the server (To see the blocking > alerts in the kibana) > https://blog.wazuh.com/blocking-attacks-active-response/ > > <agent_config name = "xxxxxxxxxxx"> > <localfile> > <log_format> syslog </ log_format> > <location> /var/ossec/logs/active-responses.log </ location> > </ localfile> > </ agent_config> > > > When an alert level > 8 is generated in another agent, the firewall-drop of > agent 001 blocks the ip. But that IP has not sent any request to agent 001. > I'm not sure I understand the problem. AR is configured to block IPs that trigger an alert at level 8 and above. An IP triggered an alert at level 8 or above and was blocked. Works as designed? > Thank you > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
