2 - Official SMB rules for OSSEC.
4 - Copyright (C) 2009 Trend Micro Inc.
7 - This program is a free software; you can redistribute it
8 - and/or modify it under the terms of the GNU General Public
9 - License (version 2) as published by the FSF - Free Software
12 - License details: http://www.ossec.net/en/licensing.html
14 - Test logs sent by: Kayvan A. Sylvan <kayvan at sylvan.com>
19 <group name="syslog,smbd,">
20 <rule id="13100" level="0" noalert="1">
21 <decoded_as>smbd</decoded_as>
22 <description>Grouping for the smbd rules.</description>
25 <rule id="13101" level="0">
26 <if_sid>13100</if_sid>
27 <match>getpeername failed. Error was Transport endpoint</match>
28 <description>Samba network problems.</description>
31 <rule id="13102" level="5">
32 <if_sid>13100</if_sid>
33 <match>Denied connection from|Connection denied from</match>
34 <description>Samba connection denied.</description>
35 <group>access_denied,</group>
38 <rule id="13103" level="0">
39 <if_sid>13100</if_sid>
40 <match>Connection reset by peer</match>
41 <description>Samba network problems.</description>
44 <rule id="13104" level="5">
45 <if_sid>13100</if_sid>
46 <match>Permission denied--</match>
47 <description>User action denied by configuration.</description>
48 <group>access_denied,</group>
51 <rule id="13105" level="3">
52 <if_sid>13100</if_sid>
53 <match>Unable to connect to CUPS server</match>
54 <description>Samba network problems (unable to connect).</description>
56 </group> <!-- SYSLOG,SMBD, -->