OSSEC-abnormal-behavior-active-repsonse

31 visningar
Hoppa till det första olästa meddelandet

James Siegel

oläst,
19 maj 2016 12:42:042016-05-19
till ossec-list
I have a set of subnets that are whitelisted.
The server and agents were installed quite some time ago and are on 2.81.

The server and the agents have been restarted at various times over the past months as part of update/patching processes.

The conf file was not changed during those time periods.

My boss was locked out by active response, after successfully logging in, then trying to su up to root, that occurred last Thursday.

The CEO was locked out of a device last night.

In both those instance, the devices they were originating from were part of whitelisted subnets.

Somehow, suddenly random occurrences of locking out whitelisted devices?


theresa mic-snare

oläst,
20 maj 2016 10:09:072016-05-20
till ossec-list
Have you checked the active responses log on the respective agent/device? /var/ossec/logs/active-responses.log
or on Windows systems C:\Program Files (x86)\ossec-agent\active-response\active-responses.log

Antonio Querubin

oläst,
20 maj 2016 13:15:212016-05-20
till ossec...@googlegroups.com
How are you configuring those white listed subnets in the config - as a series of individual addresses?

Sent from my iPad
--

---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
Svara alla
Svara författaren
Vidarebefordra
0 nya meddelanden