2 - Official Policy rules for OSSEC.
4 - Copyright (C) 2009 Trend Micro Inc.
7 - This program is a free software; you can redistribute it
8 - and/or modify it under the terms of the GNU General Public
9 - License (version 2) as published by the FSF - Free Software
12 - License details: http://www.ossec.net/en/licensing.html
16 <group name="policy_violation,">
17 <rule id="17101" level="9">
18 <if_group>authentication_success</if_group>
19 <time>6 pm - 8:30 am</time>
20 <description>Successful login during non-business hours.</description>
21 <group>login_time,</group>
24 <rule id="17102" level="9">
25 <if_group>authentication_success</if_group>
26 <weekday>weekends</weekday>
27 <description>Successful login during weekend.</description>
28 <group>login_day,</group>
30 </group> <!-- POLICY_RULES -->