[ossec-list] wishlist idea (script)

[Jay Curtis <jay@xxxxxxxxxxxxxx>]

Question tossed in the air (for small system admins)

Wish list item for ossec -- a command line option to kill in-process attacks
where from a console you could type:

ossec [+/-] [ip address | network name | subnet ]

to kill an (any) in-progress attack simply and cleanly 

where "+" [input] fires a full "level 10" block on that "input"
and "-" would remove it (if you screwed it up)

and the block period should be 24 hours (86400 seconds)

example:
#ossec + 123.123.123.123  >> fires a full (input/output/forward) block on that 
ip
#ossec - 123.123.123.123  >> clears it
#ossec + bad.haxorz.org  >> fires a full (input/output/forward) block on that 
net name
--lastly--
#ossec + 61.62.63.0/8 blocks that subnet the same way.

Any thoughts?

JSC