[ossec-list] Re: Anyone suggest windows Firewall works with ossec?

[John Ives <jives@xxxxxxxxxxxxxxxxxxxxx>]

MdMonk wrote:
> There's talk of how to implement active-response on Microsoft Windows
> systems. Something I had brought up was to use the "netsh" command.
>
> -Chuck (MdMonk)
>
> On 7/4/07, deltamails@xxxxxxxxx <deltamails@xxxxxxxxx> wrote:
>   
>> Can anyone suggest windows firewall that works with ossec?
>>
>> Regards,
>> DM
>>     

I have been considering this as well lately and feel that using netsh to 
manipulate the IPSec filters would be the best bet. My concern has been 
how to write a script that could be used in multiple environments.  
Since only one IPSec policy can be applied at a time, I would guess that 
a config file would be necessary so that admins could set the policy to 
use along with any other settings.

John

-- 
-------------------------------------------------------------------------
John Ives                                           Phone (510) 642-7773
System & Network Security			     Cell (510) 229-8676
University of California, Berkeley
-------------------------------------------------------------------------