debian/ossec-hids/var/ossec/rules/unbound_rules.xml

   1   <!-- Copyright 2010 Dan Parriott (ddpbsd@gmail.com)
   2   -  This program is a free software; you can redistribute it
   3   -  and/or modify it under the terms of the GNU General Public
   4   -  License (version 2) as published by the FSF - Free Software
   5   -  Foundation.
   6   -
   7   -  License details: http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
   8   -->
   9
  10 <group name="syslog,unbound,">
  11
  12   <rule id="53760" level="0">
  13     <decoded_as>unbound</decoded_as>
  14     <description>Unbound grouping.</description>
  15   </rule>
  16
  17   <rule id="53761" level="1">
  18     <if_sid>53760</if_sid>
  19     <match> notice: </match>
  20     <description>Notice grouping.</description>
  21   </rule>
  22
  23   <rule id="53762" level="1">
  24     <if_sid>53760</if_sid>
  25     <match> info: </match>
  26     <description>Info grouping.</description>
  27   </rule>
  28
  29   <rule id="53770" level="2">
  30     <if_sid>53761</if_sid>
  31     <match>sendto failed: Can't assign requested address</match>
  32     <description>Can't assign requested address.</description>
  33   </rule>
  34
  35   <rule id="53771" level="0">
  36     <if_sid>53762</if_sid>
  37     <match> A IN$</match>
  38     <description>DNS A request.</description>
  39   </rule>
  40
  41   <rule id="53772" level="0">
  42     <if_sid>53762</if_sid>
  43     <match> AAAA IN$</match>
  44     <description>DNS AAAA request.</description>
  45   </rule>
  46
  47   <rule id="53773" level="7">
  48     <if_sid>53771,53772</if_sid>
  49     <url>.top.|.to.|.gq.|.cf.|.men.|.loan.|.ml.|.work.|.click.|.tk.|.country.|.pw.|.party.|.trade.|.review.|.club.|.bid.|.country.|.stream.|.download.|.xin.|.gdn.|.racing.|.jetzt.|.win.|.vip.|.ren.|.kim.|.mom.|.date.|.wang.|.accountants.|.science.|.work.|.ninja.|.xyz.|.faith.|.zip.|.racing.|.cricket.|.space.|.realtor.|.christmas.|.gdn.|.pro.</url>
  50     <description>Maybe critical URL requested</description>
  51   </rule>
  52
  53 </group>