Active Response

The Active Response feature within OSSEC can run applications on an agent or server in response to certain triggers. These triggers can be specific alerts, alert levels, or rule groups.

The active response framework is also what allows an OSSEC administrator to start a syscheck scan or restart OSSEC on a remote agent.

Disabling active response

Different configuration elements disable active response at different scopes:

<active-response> with <disabled>yes</disabled>

Skips one command binding; other bindings still run.

<client> with <disable-active-response>yes</disable-active-response>

Stops all active-response execution on that agent.

See ossec.conf: Active Response Options and ossec.conf: Client Options for syntax.

Bundled active-response scripts are documented in Bundled active-response scripts.

• Creating Customized Active Responses
  • Creating the command
  • Configure the Active response
  • Create active response script
  • Restart OSSEC and test
• Bundled active-response scripts
  • Firewall and network blocking
  • Account and service actions
  • Notifications and integrations
  • Configuration example
• UNIX: Active Response Configuration
  • Commands Configuration
  • Responses Configuration
  • Active Response Tools
• Windows: Active Response Configuration
• Understanding Active Response with FreeBSD
  • How does OSSEC know which firewall is being used?
  • How do I change which script is used by an agent?