debian/ossec-hids/usr/share/doc/ossec-hids/contrib/ossec-testing/tests/openbsd-httpd.ini

   1 [access]
   2 log 1 pass = wafflelab.online 192.168.18.8 - - [08/Jul/2018:00:29:48 -0400] "GET / HTTP/1.0" 302 0
   3 log 2 pass = wafflelab.online 192.168.18.8 - - [08/Jul/2018:00:32:57 -0400] "GET /nmaplowercheck1531024375 HTTP/1.1" 302 0
   4 rule = 31100
   5 alert = 0
   6 decoder = openbsd-httpd
   7
   8 [POST]
   9 log 1 pass = www.wafflelab.online 192.168.18.8 - - [08/Jul/2018:00:33:13 -0400] "POST /sdk HTTP/1.1" 404 0
  10
  11 rule = 31530
  12 alert = 3
  13 decoder = openbsd-httpd
  14