[Prelude Universal SIM system] #343: OSSEC-HIDS 1.6.1 always sets assessment.impact.completion = succeded
"Prelude Universal SIM system" <[email protected]> Sun, 25 Jan 2009 19:06:12 -0000
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#343: OSSEC-HIDS 1.6.1 always sets assessment.impact.completion = succeded
----------------------------------+-----------------------------------------
Reporter: dtakemori@… | Type: defect
Status: new | Priority: normal
Milestone: | Component: Sensor development/review
Version: 0.9 | Severity: normal
Keywords: |
----------------------------------+-----------------------------------------
Example: the IDMEF alerts for both of these logs
WinEvtLog: Security: AUDIT_SUCCESS(673): Security: SYSTEM: NT
AUTHORITY: SERVER: user@DOMAIN DOMAIN PC$ %{SOMERANDOMUIDHERE} 0x40810010
0x17 10.10.10.10 - {SOMEOTHERUID} -
WinEvtLog: Security: AUDIT_FAILURE(673): Security: SYSTEM: NT
AUTHORITY: SERVER: - 0x2 - 10.10.10.10 0x20 - -
have assessment.impact.completion = succeeded
See also: http://marc.info/?t=123274084100006&r=1&w=2
--
Ticket URL: <https://trac.prelude-ids.org/ticket/343>
Prelude Universal SIM system <http://www.prelude-ids.com>
Prelude Universal SIM system
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel