X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;ds=sidebyside;f=etc%2Frules%2Flinux_usbdetect_rules.xml;fp=etc%2Frules%2Flinux_usbdetect_rules.xml;h=07577fc09048ea4434ae14a70c429111946dc1fe;hb=3f728675941dc69d4e544d3a880a56240a6e394a;hp=0000000000000000000000000000000000000000;hpb=927951d1c1ad45ba9e7325f07d996154a91c911b;p=ossec-hids.git

diff --git a/etc/rules/linux_usbdetect_rules.xml b/etc/rules/linux_usbdetect_rules.xml
new file mode 100644
index 0000000..07577fc
--- /dev/null
+++ b/etc/rules/linux_usbdetect_rules.xml
@@ -0,0 +1,43 @@
+<!-- OSSEC USB-detection Rule for Linux - https://www.thomas-krenn.com/de/wiki/Ubuntu_Syslog -->
+
+<group name="linux, usb,">
+	
+  <rule id="53600" level="0">
+    <program_name>kernel</program_name>
+    <match>usb</match>
+    <description>Linux USB detection messages grouped</description>
+  </rule>
+
+	
+  <rule id="53601" level="8">
+    <if_sid>53600</if_sid>
+    <match>New USB device found</match>
+    <description>A new USB device was found by the system</description>
+    <group>linux,</group>
+  </rule>
+
+	
+  <rule id="53602" level="8">
+    <if_sid>53600</if_sid>
+    <match>new low-speed USB device</match>
+    <description>New Low-Speed USB Device was connected.</description>
+    <group>linux,</group>
+  </rule>
+
+
+  <rule id="53603" level="8">
+    <if_sid>53600</if_sid>
+    <match>new high-speed USB device</match>
+    <description>New High-Speed USB Device was connected</description>
+    <group>linux,</group>
+  </rule>
+
+	
+  <rule id="53604" level="3">
+    <if_sid>53600</if_sid>
+    <match>USB disconnect</match>
+    <description>USB device was disconnected</description>
+    <group>linux,</group>
+  </rule>
+
+</group>