3 # Ossec official rules should be under some of these
6 # Local rules should go from 100000 to 120000.
8 # Every rule will also have a revision attribute (if modified).
9 # *default revision is 0 (when first added).
11 00000 - 00999 Internally reserved for ossec
12 01000 - 01999 General syslog
15 02500 - 02699 Access control
16 02700 - 02729 Mail/procmail
19 02860 - 02899 Mount/Automount
21 03100 - 03299 Sendmail
25 03700 - 03799 MailScanner
27 04100 - 04299 Generic Firewall
28 04300 - 04499 Cisco PIX Firewall
29 04500 - 04699 Netscreen Firewall
31 05100 - 05299 Kernels (Linux, Unix, etc)
34 05500 - 05599 Pam unix
37 05900 - 05999 Adduser or user deletion.
39 07100 - 07199 Tripwire
40 07200 - 07299 Arpwatch
41 07300 - 07399 Symantec Anti Virus
44 09200 - 09299 Squid syslog
45 09300 - 09399 Horde IMP
51 11300 - 11399 Pure-FTPD
54 12100 - 12299 Named (bind DNS)
56 13100 - 13299 Samba (smbd)
58 14100 - 14199 Racoon SSL
59 14200 - 14299 Cisco VPN Concentrator
63 18100 - 18499 Windows system
64 18500 - 18650 Sysmon rules
65 18651 - 18750 MS IPSec rules
67 20300 - 20499 IDS (Snort specific)
68 20500 - 20509 Windows PowerShell
70 30100 - 30999 Apache error log
71 31100 - 31199 Web access log
73 31501 - 32000 Web Appsec rules
77 40100 - 40499 Attack patterns
78 40500 - 40599 Privilege escalation
80 40600 - 40699 Scan patterns
82 40900 - 40999 Firewalld
84 51500 - 51999 OpenBSD rules
85 52000 - 52499 Apparmor rules
86 52500 - 53199 clam av rules
87 53200 - 53499 nsd rules
88 53500 - 53299 opensmtpd rules
89 53300 - 53399 owncloud rules
90 53400 - 53500 proxmox ve rules
91 53501 - 53550 OpenSMTPd rules
93 53600 - 53625 linux usb detection rules
94 53626 - 53630 ms usb detection rules
95 53631 - 53699 ms firewall rules
96 53700 - 53749 PSAD rules
97 53750 - 53799 unbound rules
98 53800 - 53825 Kaspersky Endpoint Security 10 for Linux rules
99 53826 - 53829 MHN - Dionaea
100 53830 - 53840 MHN - Cowrie
101 56000 - 56200 FreeBSD rules
103 100000 - 109999 User defined rules