I have observed that many times ossec gives alerts which are not related to
the rule id it is matching. For example below is a success sudo but it
matched rule id 5301
{"crit":5,"id":5301,"component":"XXXX->X.X.X.X","classification":" syslog,
su,authentication_failed,","description":"User missed the password to
change UID (user id).","message":"May 22 03:04:42 XXXX su[106523]:
Successful su for qa by root"}
--
_____________________________________________________________
The
information contained in this communication is intended solely for the use
of the individual or entity to whom it is addressed and others authorized
to receive it. It may contain confidential or legally privileged
information. If you are not the intended recipient you are hereby notified
that any disclosure, copying, distribution or taking any action in reliance
on the contents of this information is strictly prohibited and may be
unlawful. If you have received this communication in error, please notify
us immediately by responding to this email and then delete it from your
system. The firm is neither liable for the proper and complete transmission
of the information contained in this communication nor for any delay in its
receipt.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
