[ossec-list] Windows rules

[Amedeo Salvati <amedeo.salvati@xxxxxxxxxx>]

Hi Daniel,

recently i saw that on windows rules:

 <rule id="8006" level="5">
   <if_sid>8005</if_sid>
   <id>^529|^530|^531|^532|^533|^534|^535|^536|^537|^539</id>
   <group>authentication_failed</group>
   <description>Windows Logon Failure.</description>
 </rule>

there aren't 681 code for authentication failed code on MS win 2000 DC 
and 680 authentication success|failed code for authentication via NTLM 
on MS win 2003 DC

Please refer to:
http://www.ultimatewindowssecurity.com/events/com304.html

and:
http://www.ultimatewindowssecurity.com/ntlmerrors.html

don't forget that on windows 2003 DC 680 code is logged either for 
succes and failed authentication!


Hope it helps
amedeo