Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make system_name available for CDB list matching #628

Open
labrown opened this issue Jun 23, 2015 · 1 comment
Open

Make system_name available for CDB list matching #628

labrown opened this issue Jun 23, 2015 · 1 comment

Comments

@labrown
Copy link
Contributor

labrown commented Jun 23, 2015

I have a use case where I need to be able to do a CDB list lookup based on the 'system_name' decoded from Windows server logs, but that is not an available variable for CDB lists.

@jrossi
Copy link
Member

jrossi commented Jun 24, 2015

https://github.com/ossec/ossec-hids/blob/master/src/analysisd/analysisd.c#L1365
https://github.com/ossec/ossec-hids/blob/master/src/analysisd/analysisd.c#L1373

lf->systemname = field;

#define RULE_HOSTNAME 256

would be the starting point of adding this. No logic changes would be needed. If you run into problems I would be happy to help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants