1 <!-- @(#) $Id: ./etc/rules/local_rules.xml, 2011/09/08 dcid Exp $
3 - Example of local rules for OSSEC.
5 - Copyright (C) 2009 Trend Micro Inc.
8 - This program is a free software; you can redistribute it
9 - and/or modify it under the terms of the GNU General Public
10 - License (version 2) as published by the FSF - Free Software
13 - License details: http://www.ossec.net/en/licensing.html
17 <!-- Modify it at your will. -->
19 <group name="local,syslog,">
21 <!-- Note that rule id 5711 is defined at the ssh_rules file
22 - as a ssh failed login. This is just an example
23 - since ip 192.0.2.1 shouldn't be used anywhere.
24 - Level 0 means ignore.
26 <rule id="100001" level="0">
28 <srcip>192.0.2.1</srcip>
29 <description>Example of rule that will ignore sshd </description>
30 <description>failed logins from IP 1.1.1.1.</description>
34 <!-- This example will ignore ssh failed logins for the user name XYZABC.
37 <rule id="100020" level="0">
40 <description>Example of rule that will ignore sshd </description>
41 <description>failed logins for user XYZABC.</description>
46 <!-- Specify here a list of rules to ignore. -->
48 <rule id="100030" level="0">
49 <if_sid>12345, 23456, xyz, abc</if_sid>
50 <description>List of rules to be ignored.</description>
54 </group> <!-- SYSLOG,LOCAL -->