Jochheim-edv/JE-R5-SIEM-ScriptUpdates
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mense/Server/UBNT/DE225680SBEZ01/ossec.conf aktualisiert

Browse Source
This commit is contained in:
Lukas Kuap
2026-01-23 17:06:34 +00:00
parent f02fd29599
commit c1eb486c39
1 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
Mense/Server/UBNT/DE225680SBEZ01/ossec.conf
View File

@@ -114,6 +114,9 @@
<!-- Directories to check (perform all possible verifications) --> <!-- Directories to check (perform all possible verifications) -->
<directories>/etc,/usr/bin,/usr/sbin</directories> <directories>/etc,/usr/bin,/usr/sbin</directories>
<directories>/bin,/sbin,/boot</directories> <directories>/bin,/sbin,/boot</directories>
<directories check_all="yes">/etc/ssh</directories>
<directories check_all="yes">/etc/cups</directories>
<directories check_all="yes">/var/spool/cups</directories>
<!-- Files/directories to ignore --> <!-- Files/directories to ignore -->
<ignore>/etc/mtab</ignore> <ignore>/etc/mtab</ignore>
@@ -194,11 +197,47 @@
<location>journald</location> <location>journald</location>
</localfile> </localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/auth.log</location>
</localfile>
<localfile> <localfile>
<log_format>syslog</log_format> <log_format>syslog</log_format>
<location>/var/ossec/logs/active-responses.log</location> <location>/var/ossec/logs/active-responses.log</location>
</localfile> </localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/cups/error_log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/clamav/fullscan.log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/clamav/quickscan.log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/clamav/freshclam.log</location>
</localfile>
<localfile>
<log_format>full_command</log_format>
<command>faillog -a</command>
<frequency>360</frequency>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/cups/access_log</location>
</localfile>
<localfile> <localfile>
<log_format>syslog</log_format> <log_format>syslog</log_format>
<location>/var/log/dpkg.log</location> <location>/var/log/dpkg.log</location>