Active response configuration

116 views
Skip to first unread message

Adiel Navarro

unread,
Sep 23, 2016, 4:56:44 PM9/23/16
to wa...@googlegroups.com

How can I re-active “active response” in a ossec client?

 

During the initial configuration, active response don’t be activated

 

Victor Fernandez

unread,
Sep 24, 2016, 9:23:06 AM9/24/16
to Wazuh mailing list, adiel....@mail.telcel.com
Hi Adiel,

In order to enable Active Reponse, edit the file /var/ossec/etc/ossec.conf and find these lines:

<active-response>
  <disabled>yes</disabled>
</active-response>

Remove the line "<disabled>yes</disabled>" or replace the word "yes" for "no". After that, you should restart your OSSEC agent by executing:

/var/ossec/bin/ossec-control restart

There is no way to re-enable AR by editing the shared file "/var/ossec/etc/shared/agent.conf" because OSSEC doesn't read the <active-response> setting from that file.

Hope it helps.
Best regards.

Victor.

Adiel Navarro

unread,
Sep 28, 2016, 4:41:50 PM9/28/16
to Victor Fernandez, Wazuh mailing list

In ossec.conf in the server, I cannot find <active-response> lines

 

Only I got this..

 

<ossec_config>

  <global>

    <email_notification>no</email_notification>

  </global>

 

  <rules>

    <include>rules_config.xml</include>

    <include>pam_rules.xml</include>

    <include>sshd_rules.xml</include>

    <include>telnetd_rules.xml</include>

    <include>syslog_rules.xml</include>

    <include>arpwatch_rules.xml</include>

    <include>symantec-av_rules.xml</include>

    <include>symantec-ws_rules.xml</include>

    <include>pix_rules.xml</include>

    <include>named_rules.xml</include>

    <include>smbd_rules.xml</include>

    <include>vsftpd_rules.xml</include>

    <include>pure-ftpd_rules.xml</include>

    <include>proftpd_rules.xml</include>

    <include>ms_ftpd_rules.xml</include>

    <include>ftpd_rules.xml</include>

    <include>hordeimp_rules.xml</include>

    <include>roundcube_rules.xml</include>

    <include>wordpress_rules.xml</include>

    <include>cimserver_rules.xml</include>

    <include>vpopmail_rules.xml</include>

    <include>vmpop3d_rules.xml</include>

    <include>courier_rules.xml</include>

    <include>web_rules.xml</include>

    <include>web_appsec_rules.xml</include>

    <include>apache_rules.xml</include>

    <include>nginx_rules.xml</include>

    <include>php_rules.xml</include>

    <include>mysql_rules.xml</include>

    <include>postgresql_rules.xml</include>

    <include>ids_rules.xml</include>

    <include>squid_rules.xml</include>

    <include>firewall_rules.xml</include>

    <include>cisco-ios_rules.xml</include>

    <include>netscreenfw_rules.xml</include>

    <include>sonicwall_rules.xml</include>

    <include>postfix_rules.xml</include>

    <include>sendmail_rules.xml</include>

    <include>imapd_rules.xml</include>

    <include>mailscanner_rules.xml</include>

    <include>dovecot_rules.xml</include>

    <include>ms-exchange_rules.xml</include>

    <include>racoon_rules.xml</include>

    <include>vpn_concentrator_rules.xml</include>

    <include>spamd_rules.xml</include>

    <include>msauth_rules.xml</include>

    <include>mcafee_av_rules.xml</include>

    <include>trend-osce_rules.xml</include>

    <include>ms-se_rules.xml</include>

    <!-- <include>policy_rules.xml</include> -->

    <include>zeus_rules.xml</include>

    <include>solaris_bsm_rules.xml</include>

    <include>vmware_rules.xml</include>

    <include>ms_dhcp_rules.xml</include>

    <include>asterisk_rules.xml</include>

   <include>ossec_rules.xml</include>

    <include>attack_rules.xml</include>

    <include>openbsd_rules.xml</include>

    <include>clam_av_rules.xml</include>

    <include>dropbear_rules.xml</include>

    <include>local_rules.xml</include>

  </rules> 

 

 <syscheck>

    <!-- Frequency that syscheck is executed - default to every 22 hours -->

    <frequency>300</frequency>

   

    <!-- Directories to check  (perform all possible verifications) -->

    <alert_new_files>yes</alert_new_files>

    <directories report_changes="yes" realtime="yes" check_all="yes" check_owner="yes" check_group="yes" check_perm="yes">/etc/hosts.

allow,/etc/hosts.deny,/etc/rsyslog.conf,/etc/xinetd.conf</directories>

    <directories  report_changes="yes" realtime="yes" check_all="yes" check_owner="yes" check_group="yes" check_perm="yes">/root,/tmp

</directories>

    <directories  report_changes="yes" realtime="yes" check_all="yes" check_owner="yes" check_group="yes" check_perm="yes">/etc/audit

</directories>

    <auto_ignore>no</auto_ignore>

 

    <!-- Files/directories to ignore -->

    <ignore>/etc/mtab</ignore>

    <ignore>/etc/mnttab</ignore>

    <ignore>/etc/mail/statistics</ignore>

    <ignore>/etc/random-seed</ignore>

    <ignore>/etc/adjtime</ignore>

    <ignore>/etc/httpd/logs</ignore>

    <ignore>/etc/utmpx</ignore>

    <ignore>/etc/wtmpx</ignore>

    <ignore>/etc/cups/certs</ignore>

    <ignore>/etc/dumpdates</ignore>

    <ignore>/etc/svc/volatile</ignore>

    <ignore>/tmp/hsperfdata_tomcat/28435</ignore>

 

    <!-- Windows files to ignore -->

    <ignore>C:\WINDOWS/System32/LogFiles</ignore>

    <ignore>C:\WINDOWS/Debug</ignore>

    <ignore>C:\WINDOWS/WindowsUpdate.log</ignore>

    <ignore>C:\WINDOWS/iis6.log</ignore>

    <ignore>C:\WINDOWS/system32/wbem/Logs</ignore>

    <ignore>C:\WINDOWS/system32/wbem/Repository</ignore>

    <ignore>C:\WINDOWS/Prefetch</ignore>

    <ignore>C:\WINDOWS/PCHEALTH/HELPCTR/DataColl</ignore>

    <ignore>C:\WINDOWS/SoftwareDistribution</ignore>

    <ignore>C:\WINDOWS/Temp</ignore>

    <ignore>C:\WINDOWS/system32/config</ignore>

    <ignore>C:\WINDOWS/system32/spool</ignore>

    <ignore>C:\WINDOWS/system32/CatRoot</ignore>

  </syscheck>

 

  <rootcheck>

    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>

    <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>

    <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>

    <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit>

    <system_audit>/var/ossec/etc/shared/cis_rhel_linux_rcl.txt</system_audit>

    <system_audit>/var/ossec/etc/shared/cis_rhel5_linux_rcl.txt</system_audit>

  </rootcheck>

 

  <global>

    <white_list>127.0.0.1</white_list>

    <white_list>^localhost.localdomain$</white_list>

  </global>

 

  <remote>

    <connection>secure</connection>

  </remote>

 

  <alerts>

    <log_alert_level>1</log_alert_level>

  </alerts>

 

  <command>

    <name>host-deny</name>

    <executable>host-deny.sh</executable>

    <expect>srcip</expect>

    <timeout_allowed>yes</timeout_allowed>

  </command> 

 

  <command>

    <name>firewall-drop</name>

    <executable>firewall-drop.sh</executable>

    <expect>srcip</expect>

    <timeout_allowed>yes</timeout_allowed>

  </command> 

 

  <command>

    <name>disable-account</name>

    <executable>disable-account.sh</executable>

    <expect>user</expect>

    <timeout_allowed>yes</timeout_allowed>

  </command> 

 

  <command>

    <name>restart-ossec</name>

    <executable>restart-ossec.sh</executable>

    <expect></expect>

  </command>

                 

 

  <command>

    <name>route-null</name>

    <executable>route-null.sh</executable>

    <expect>srcip</expect>

    <timeout_allowed>yes</timeout_allowed>

  </command>

 

  <!-- Files to monitor (localfiles) -->

 

  <localfile>

    <log_format>syslog</log_format>

    <location>/var/log/messages</location>

  </localfile>

 

  <localfile>

    <log_format>syslog</log_format>

    <location>/var/log/maillog</location>

  </localfile>

 

  <localfile>

    <log_format>apache</log_format>

    <location>/var/log/httpd/access_log</location>

  </localfile>

 

  <localfile>

    <log_format>full_command</log_format>

    <command>df -h</command>

  </localfile>

 

  <localfile>

    <log_format>full_command</log_format>

    <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command>

  </localfile>

 

  <localfile>

    <log_format>full_command</log_format>

    <command>last -n 5</command>

  </localfile>

 

<localfile>

    <log_format>full_command</log_format>

    <command>ps -fea</command>

  </localfile>

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/7d6635d1-6e10-49e7-a45e-50e6fd747b7e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Victor Fernandez

unread,
Sep 29, 2016, 5:27:06 AM9/29/16
to Wazuh mailing list
Hi Adiel.

Active Response enabling or disabling is a per-agent setting. You should find that configuration in the ossec.conf file at agents.

Fix those lines at the ossec.conf at every agent where You want to re-enable Active Response, and then restart the agents.

Best regards.
Víctor.
Reply all
Reply to author
Forward
0 new messages