{"id":58,"date":"2010-03-11T18:35:53","date_gmt":"2010-03-11T18:35:53","guid":{"rendered":"https:\/\/defragged.org\/ossec\/?p=58"},"modified":"2020-07-01T18:37:17","modified_gmt":"2020-07-01T18:37:17","slug":"alerting-when-a-log-or-output-of-a-command-changes","status":"publish","type":"post","link":"https:\/\/defragged.org\/ossec\/2010\/03\/alerting-when-a-log-or-output-of-a-command-changes\/","title":{"rendered":"Alerting when a log or output of a command changes"},"content":{"rendered":"\n<p>If you want to create alerts when a log or the output of a command changes, take a look at the new &lt;check_diff \/> option in the rules (available on the latest snapshot).<\/p>\n\n\n\n<p>To demonstrate with an example, we will create a rule to alert when there is a new port open in listening mode on our server.<\/p>\n\n\n\n<p>First, we configure OSSEC to run the \u2018netstat -tan |grep LISTEN\u2019 command by adding the following to ossec.conf:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;localfile>\n  &lt;log_format>full_command&lt;\/log_format>\n  &lt;command>netstat -tan |grep LISTEN|grep -v 127.0.0.1&lt;\/command>\n&lt;\/localfile><\/code><\/pre>\n\n\n\n<p>After that, I add a rule to alert when its output changes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;rule id=\"140123\" level=\"7\">\n  &lt;if_sid>530&lt;\/if_sid>\n  &lt;match>ossec: output: 'netstat -tan |grep LISTEN&lt;\/match>\n  &lt;check_diff \/>\n  &lt;description>Listened ports have changed.&lt;\/description>\n&lt;\/rule><\/code><\/pre>\n\n\n\n<p>Note that we use the &lt;check_diff \/&gt; option. The first time it receives the event, it will store in an internal database. Every time it receives the same event, it will compare against what we have store and only alert if the output changes.<\/p>\n\n\n\n<p>In our example, after configuring OSSEC, I started netcat to listen on port 23456 and that\u2019s the alert I got:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OSSEC HIDS Notification.\n2010 Mar 11 19:56:30\n\nReceived From: XYZ->netstat -tan |grep LISTEN|grep -v 127.0.0.1\nRule: 140123 fired (level 7) -> \"Listened ports have changed.\"\nPortion of the log(s):\n\nossec: output: 'netstat -tan |grep LISTEN|grep -v 127.0.0.1':\ntcp4       0      0 *.23456           *.*               LISTEN\ntcp4       0      0 *.3306            *.*               LISTEN\ntcp4       0      0 *.25              *.*               LISTEN\nPrevious output:\nossec: output: 'netstat -tan |grep LISTEN|grep -v 127.0.0.1':\ntcp4       0      0 *.3306            *.*               LISTEN\ntcp4       0      0 *.25              *.*               LISTEN\n<\/code><\/pre>\n\n\n\n<p>What do you think? We can probably extend this idea to create very interesting rules\u2026<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you want to create alerts when a log or the output of a command changes, take a look at the new &lt;check_diff \/> option in the rules (available on the latest snapshot). To demonstrate with an example, we will create a rule to alert when there is a new port open in listening mode [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/58"}],"collection":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/comments?post=58"}],"version-history":[{"count":1,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/58\/revisions"}],"predecessor-version":[{"id":59,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/58\/revisions\/59"}],"wp:attachment":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/media?parent=58"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/categories?post=58"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/tags?post=58"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}