[ossec-list] IIS rule to alert on blank cs-host

["List Subscriptions" <lists.canuck.eh@xxxxxxxxx>]

In order to troubleshoot a web app I would like to have an IIS rule to
alert when someone accesses a web page by IP address rather then
hostname.  I believe this should be possible by having a rule that
alerts on blank cs-host field.  Unfortunately I'm quite new to OSSEC
and don't know how to accomplish this.  I believe modifications need
to be made to both decoder.xml and a rules file.

First I need to add cs-host to the following decoder, right?

<decoder name="web-accesslog-iis6">
 <parent>windows-date-format</parent>
 <type>web-log</type>
 <use_own_name>true</use_own_name>
 <prematch offset="after_parent">^W3SVC\d+ \S+ \S+ \S+ </prematch>
 <regex offset="after_prematch">^(\S+) \S+ \d+ \S+ (\d+.\d+.\d+.\d+) </regex>
 <regex>\S+ \S+ \S+ \S+ \S+ (\d+) </regex>
 <order>url, srcip, id</order>
</decoder>

Then write a rule looking for blank cs-host, right?

Thanks in advance!