active-response question on the ossec server

[Peter M. Abraham]

Greetings:

We use the <location>all</location> in active-response to block
attacks on all agents.

I just noticed there is no /var/ossec/logs/active-responses.log on the
ossec server itself.

Is there a way to have active-response active on the ossec server so
that in that way the ossec server is also treated as an agent?

Thank you.

[Daniel Cid]

Hi Peter,

Just changing the config to the following should to it:

<location>all|server</location>

Hope it helps.

--
Daniel B. Cid
dcid ( at ) ossec.net

[Peter M. Abraham]

Hi Daniel:

Thank you.

[Peter M. Abraham]

Hi Daniel:

I just found out that the "all|server" ends up just using active-
response on the server. The agents were not updated -- not on the
initial receiving agent, or any of the other agents.

Please advise.

Thank you.

[Peter M. Abraham]

Greetings Daniel:

The "all|server" in location ended up just putting the active-response
on the server, and missed all of the agents.

If I used two sets of active responses (same sid's), one with location
all and one with location server, would that work or would the last
set overwrite the first set?

Thank you.

[Peter M. Abraham]

[Daniel Cid]

Hi Peter,

Yes, sorry for the bad advice. It will not work properly the way I said. I just
did quick test in here and having two set of responses, one with the "server"
as the location and the other as "all" , should do what you want.

Hope it helps.

--
Daniel B. Cid
dcid ( at ) ossec.net

[Peter M. Abraham]

Hi Daniel:

Welcome to the human race <smile>, and thank you for letting me know
about having two entries.

I'm testing that now.

Thank you again.