Bundled active-response scripts¶

Scripts are installed to /var/ossec/active-response/bin/. Each must be referenced from a <command> block in ossec.conf before use. Most blocking scripts expect srcip in <expect>.

Firewall and network blocking¶

Script	Expect	Notes
host-deny.sh firewall-drop.sh firewalld-drop.sh nftables-drop.sh pf.sh ipfw.sh ipfw_mac.sh npf.sh route-null.sh ip-customblock.sh firewall-drop.cmd netsh.cmd route-null.cmd	srcip srcip srcip srcip srcip srcip srcip srcip srcip srcip srcip srcip srcip	Adds IP to `/etc/hosts.deny` (tcp wrappers) iptables `OSSEC` chain, ipfilter, AIX IPSec Linux with firewalld; enable manually Linux nftables; requires pre-configured sets OpenBSD/FreeBSD PF table `ossec_fwtable` FreeBSD IPFW table 1 macOS IPFW NetBSD NPF Null-route the source IP Template for custom block actions Windows firewall block Windows `netsh` firewall block Windows null route

Account and service actions¶

Script	Expect	Notes
disable-account.sh restart-ossec.sh restart-ossec.cmd	username (none) (none)	Locks account via `passwd -l` or AIX chuser Restarts OSSEC on the target host Windows agent restart

Notifications and integrations¶

These scripts require API keys or credentials edited inside the script before use.

Script	Expect	Notes
ossec-slack.sh ossec-pagerduty.sh ossec-tweeter.sh cloudflare-ban.sh ossec-aws-waf.sh	(none) (none) (none) srcip srcip	Posts alert to Slack via incoming webhook Creates PagerDuty incident via API key Posts alert text to Twitter/X Adds IP to Cloudflare block list (API token) Adds IP to AWS WAF IP set (requires AWS CLI)

Configuration example¶

<command>
  <name>slack-notify</name>
  <executable>ossec-slack.sh</executable>
  <expect></expect>
  <timeout_allowed>no</timeout_allowed>
</command>

<active-response>
  <command>slack-notify</command>
  <location>server</location>
  <level>10</level>
</active-response>

See UNIX: Active Response Configuration for command and active-response syntax.