[ossec-list] syscheck error

2018-04-16 Thread Cooper
I am getting the following error from syscheckd when starting up OSSEC 2.9.3: 2018/04/16 13:01:14 ossec-analysisd: INFO: Reading rules file: 'sshd_rules.xml' 2018/04/16 13:01:14 ossec-syscheckd(1121): ERROR: Glob error. Invalid pattern: '/home/*/.ssh'. 2018/04/16 13:04:35 ossec-analysisd:

[ossec-list] ossec HIDS 2.9.0 missing "Object Type" field for event it 5140

2018-04-16 Thread Ian Brown
I saw a strange log entry today that seemed to have the information put into some of the wrong fields: 2018 Apr 16 12:11:14 (workstation) 1.1.1.2->WinEvtLog 2018 Apr 16 05:11:10 > WinEvtLog: Security: AUDIT_FAILURE(5140): > Microsoft-Windows-Security-Auditing: (no user): no domain: >