{"id":156,"date":"2008-08-20T21:59:51","date_gmt":"2008-08-20T21:59:51","guid":{"rendered":"https:\/\/defragged.org\/ossec\/?p=156"},"modified":"2020-07-02T22:00:48","modified_gmt":"2020-07-02T22:00:48","slug":"active-response-on-windows","status":"publish","type":"post","link":"https:\/\/defragged.org\/ossec\/2008\/08\/active-response-on-windows\/","title":{"rendered":"Active response on Windows"},"content":{"rendered":"\n

Another big feature that we never got around to implement until now. For version 1.6, OSSEC<\/a> will come with the route-null.cmd<\/em> script to block an IP address on Windows by modifying the route to it.<\/p>\n\n\n\n

To get started, you will need at least the snapshot http:\/\/www.ossec.net\/files\/snapshots\/ossec-win32-080820.exe<\/a>
and the latest snapshot for the management server too.<\/p>\n\n\n\n

With that installed, you need to enable active response on Windows (disabled by default). To do that, just add the following to the agent\u2019s ossec.conf:<\/p>\n\n\n\n

<active-response>
<disabled>no<\/disabled>
<\/active-response><\/p><\/blockquote>\n\n\n\n

After that, you need to go to the manager and specify when to run the response. Adding the following to ossec.conf will enable the responses for alerts above level 6:<\/p>\n\n\n\n

<command>
<name>win_nullroute<\/name>
<executable>route-null.cmd<\/executable>
<expect>srcip<\/expect>
<timeout_allowed>yes<\/timeout_allowed>
<\/command><\/p>

<active-response>
<command>win_nullroute<\/command>
<location>local<\/location>
<level>6<\/level>
<timeout>600<\/timeout>
<\/active-response><\/p><\/blockquote>\n\n\n\n

With the configuration completed (and the manager restarted), you can test the active response by running the agent-control script (in this case, I am running it on agent id 185 to block ip 2.3.4.5):<\/p>\n\n\n\n

# \/var\/ossec\/bin\/agent_control -L<\/strong><\/p>

OSSEC HIDS agent_control. Available active responses:<\/p>

Response name: host-deny600, command: host-deny.sh
Response name: firewall-drop600, command: firewall-drop.sh
Response name: win_nullroute600, command: route-null.cmd<\/p>

# \/var\/ossec\/bin\/agent_control -b 2.3.4.5 -f win_nullroute600 -u 185<\/strong><\/p>

OSSEC HIDS agent_control: Running active response \u2018win_nullroute600\u2032 on: 185<\/p><\/blockquote>\n\n\n\n

And looking at the agent you should see the new entry in the route table:<\/p>\n\n\n\n

C:>route print<\/strong>
..
Active Routes:
Network Destination Netmask Gateway Interface Metric
2.3.4.5 255.255.255.255 x.y.z x.y.z 1
..<\/p><\/blockquote>\n\n\n\n

If you run into any issues, look at the ossec.log file (on the agent) for any entry for ossec-execd. If you enabled it correctly, you will see:<\/p>\n\n\n\n

2008\/08\/20 11:53:49 ossec-execd: INFO: Started (pid: 3896).<\/p><\/blockquote>\n\n\n\n

As always, we are very open to suggestions, comments, bug reports, etc.<\/p>\n\n\n\n

Thanks,<\/p>\n","protected":false},"excerpt":{"rendered":"

Another big feature that we never got around to implement until now. For version 1.6, OSSEC will come with the route-null.cmd script to block an IP address on Windows by modifying the route to it. To get started, you will need at least the snapshot http:\/\/www.ossec.net\/files\/snapshots\/ossec-win32-080820.exeand the latest snapshot for the management server too. With that installed, you need to […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5,4],"tags":[],"_links":{"self":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/156"}],"collection":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/comments?post=156"}],"version-history":[{"count":1,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/156\/revisions"}],"predecessor-version":[{"id":157,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/156\/revisions\/157"}],"wp:attachment":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/media?parent=156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/categories?post=156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/tags?post=156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}