debian/ossec-hids/var/ossec/rules/firewalld_rules.xml

   1 <group name="local,firewalld,">
   2   <rule id="40900" level="0">
   3     <program_name>^firewalld</program_name>
   4     <description>firewalld grouping</description>
   5   </rule>
   6
   7   <rule id="40901" level="1">
   8     <if_sid>40900</if_sid>
   9     <match> ERROR: </match>
  10     <description>firewalld error</description>
  11   </rule>
  12
  13   <rule id="40902" level="3">
  14     <if_sid>40901</if_sid>
  15     <match> No chain/target/match by that name.$</match>
  16     <description>Incorrect chain/target/match.</description>
  17   </rule>
  18
  19   <rule id="40903" level="2">
  20     <if_sid>40901</if_sid>
  21     <match> ZONE_ALREADY_SET$</match>
  22     <description>firewalld: zone already set.</description>
  23   </rule>
  24 </group>
  25