[ossec-list] Re: SSH Brute Force Attacks and Alerting

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Ben,

On ossec, level 1 is the least severe and level 15 the highest one. Basically,
in your configuration you are alerting on everything higher and equal
to level 7.

If you don't want to receive e-mail alerts from these rules, you have
three options:

-Reduce the level from them (see link that Tommy suggested).
-Set no_email_alert option on the rule*.
-Increase the e-mail alerting level (to 11 or higher).

*http://www.ossec.net/en/manual.html#rules

Example of setting the no_email_alert option:

 <rule id="5712" level="10" frequency="6" timeframe="120" ignore="60">
   <if_matched_sid>5710</if_matched_sid>
   <description>SSHD brute force trying to get access to </description>
   <description>the system.</description>
   <options>no_email_alert</options>
   <group>authentication_failures,</group>
 </rule>

Hope it helps.

--
Daniel B. Cid
dcid ( at ) ossec.net

On 5/2/07, Ben Ruset <ben.ruset@xxxxxxxxxxx> wrote:
> Well, am I right in assuming that the config should stop all rules
> greater than level 7 from being emailed?
>
> Is rule level 1 more servere than rule level 16?
>
> Thanks,
> -ben
>
> Tommy May wrote:
> > This was very helpful to me....(thanks to Daniel Cid)
> >
> > http://www.ossec.net/wiki/index.php/Know_How:Ignore_Rules
> >
> > This isn't just to ignore rules...this also tells you that you can ignore all rules "unless it matches a very specific pattern".
> >
> > Hope this is helpful.
> >
> > Tommy