X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;ds=sidebyside;f=etc%2Frules%2Fopenbsd_rules.xml;fp=etc%2Frules%2Fopenbsd_rules.xml;h=f970be2787ca489a1adc21aa0e78c379a0883bc7;hb=789cbc8e52da68eba3517b920ef22e000cf3c9fd;hp=171b7a0c424e4ae17de8525afaeeaef728f0d69b;hpb=ef70704f0b31b59bb719b884d6a99cb9e3e2044a;p=ossec-hids.git

diff --git a/etc/rules/openbsd_rules.xml b/etc/rules/openbsd_rules.xml
index 171b7a0..f970be2 100755
--- a/etc/rules/openbsd_rules.xml
+++ b/etc/rules/openbsd_rules.xml
@@ -197,6 +197,20 @@
     <description>hotplugd could not open a file.</description>
   </rule>
 
+  <rule id="51531" level="3">
+    <decoded_as>open-userdel</decoded_as>
+    <match>user removed: name=</match>
+    <description>User account deleted.</description>
+    <group>account_changed,</group>
+  </rule>
+
+  <rule id="51532" level="0">
+    <decoded_as>ntpd</decoded_as>
+    <match>bad peer from </match>
+    <description>Bad ntp peer.</description>
+  </rule>
+
+
 </group> <!-- SYSLOG,LOCAL -->