ossec-hids: possible-gpl-code-linked-with-openssl
ossec-hids: file-in-unusual-dir var/ossec/active-response/bin/ip-customblock.sh