From 495280d9dc4ff5efd555f50e65a120df1b780003 Mon Sep 17 00:00:00 2001
From: Dominik Lisiak <dominik.lisiak@bemsoft.pl>
Date: Sat, 13 Oct 2018 20:51:51 +0200
Subject: Initial commit for version 3.0.0

---
 .../files/rules-cmdout.xml.in                      | 67 ++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 security/ossec-hids-local-config/files/rules-cmdout.xml.in

(limited to 'security/ossec-hids-local-config/files/rules-cmdout.xml.in')

diff --git a/security/ossec-hids-local-config/files/rules-cmdout.xml.in b/security/ossec-hids-local-config/files/rules-cmdout.xml.in
new file mode 100644
index 0000000..59e3f4b
--- /dev/null
+++ b/security/ossec-hids-local-config/files/rules-cmdout.xml.in
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<group name="ossec,">
+
+  <rule id="56041" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-last-logins'</match>
+    <check_diff />
+    <description>List of the last logged in users.</description> 
+  </rule>
+
+  <rule id="56042" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp4-all'</match>
+    <check_diff />
+    <description>Listening IPv4 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56043" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp4'</match>
+    <check_diff />
+    <description>Listening IPv4 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56044" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp6-all'</match>
+    <check_diff />
+    <description>Listening IPv6 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56045" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-tcp6'</match>
+    <check_diff />
+    <description>Listening IPv6 TCP port opened or closed.</description>
+  </rule>
+
+  <rule id="56046" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp4-all'</match>
+    <check_diff />
+    <description>Listening IPv4 UDP port opened or closed.</description>
+  </rule>
+
+  <rule id="56047" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp4'</match>
+    <check_diff />
+    <description>Listening IPv4 UDP port opened or closed.</description>
+  </rule>
+
+  <rule id="56048" level="1">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp6-all'</match>
+    <check_diff />
+    <description>Listening IPv6 UDP port opened or closed.</description>
+  </rule>
+
+  <rule id="56049" level="7">
+    <if_sid>530</if_sid>
+    <match>ossec: output: 'freebsd-open-ports-udp6'</match>
+    <check_diff />
+    <description>Listening IPv6 UDP port opened or closed.</description>
+  </rule>
+
+</group>
-- 
cgit v1.2.3