<%= node["ossec"]["email_notification"] %> <% node["ossec"]["email_to"].sort_by {|k| k}.each do |recipient| -%> <%= recipient %> <% end -%> <%= node["ossec"]["smtp_server"] %> <%= node["ossec"]["email_from"] %> <%= node["ossec"]["email_maxperhour"] %> <%= node["ossec"]["email_idsname"] %> <%=node["ossec"]["memory_size"]%> <% node["ossec"]["white_list"].sort_by {|k| k}.each do |ip| -%> <%= ip %> <% end -%> <% node["ossec"]["load_rules"].each_pair do |name, value| if value -%> <%= name %> <% end end -%> <%= node["ossec"]["remote"]["connection"] %> <%= node.ipaddress %> <%= node["ossec"]["syslog_output"]["ip"] %> <%= node["ossec"]["syslog_output"]["port"] %> <%= node["ossec"]["syslog_output"]["min_level"] %> <%= node["ossec"]["log_alert_level"] %> <%= node["ossec"]["email_alert_level"] %> authentication_success srcip Daily report: Successful logins <% node["ossec"]["email_to"].sort_by {|k| k}.each do |recipient| -%> <%= recipient %> <% end -%> web Daily report: Web <% node["ossec"]["email_to"].sort_by {|k| k}.each do |recipient| -%> <%= recipient %> <% end -%> Daily report: Level 7 7 level <% node["ossec"]["email_to"].sort_by {|k| k}.each do |recipient| -%> <%= recipient %> <% end -%> Daily report: Level 12 12 level <% node["ossec"]["email_to"].sort_by {|k| k}.each do |recipient| -%> <%= recipient %> <% end -%> syscheck Daily report: File changes filename <% node["ossec"]["email_to"].sort_by {|k| k}.each do |recipient| -%> <%= recipient %> <% end -%> <% node["ossec"]["email_alerts"].sort_by {|k,v| k}.each do |recipient,params| locations = [] if params.has_key?('event_location_tag') locations = @ossec_agents.select{ |n| n[:tags].include?( params[:event_location_tag] ) }.map {|n2| n2.network.lanip || '172.172.172.172'} elsif params.has_key?('resolved_search') locations = params[:resolved_search] end if locations.count > 0 locations.sort_by {|k| k}.each do |location| -%> <%= recipient %> <%= location %> <% params.sort_by {|k,v| k}.each do |key, value| unless key =~ /event_location_tag|event_location_search|resolved_search/ if key.eql?('tags') value.sort_by {|k| k}.each do |tag| -%> <<%= tag %> /> <% end else -%> <<%= key %>><%= value %>> <% end end end -%> <% end else -%> <%= recipient %> <% params.sort_by {|k,v| k}.each do |key, value| unless key =~ /event_location_tag|event_location_search|resolved_search/ if key.eql?('tags') value.sort_by {|k| k}.each do |tag| -%> <<%= tag %> /> <% end else -%> <<%= key %>><%= value %>> <% end end end -%> <% end end -%> <%= node["ossec"]["syscheck"]["frequency"] %> <% node["ossec"]["syscheck"]["directories"].sort_by {|k,v| k}.each do |directory,params| -%> <%= directory %> <% end -%> <%= node["ossec"]["syscheck"]["alert_new_files"] %> <%= node["ossec"]["syscheck"]["auto_ignore"] %> <% unless node["ossec"]["syscheck"]["ignore"].nil? node["ossec"]["syscheck"]["ignore"].sort_by {|k,v|}.each do |path,params| if params["use_here"] == true type = params["type"] || "simple" if type == "simple" -%> <%= path %> <% else -%> <%= path %> <% end end end end -%> /var/ossec/etc/shared/rootkit_files.txt /var/ossec/etc/shared/rootkit_trojans.txt <% node["ossec"]["command"].each_pair do |command, params| if params["enabled"] == true && \ params["use_here"] == true -%> <%= command %> <% params.each_pair do |param, value| unless (param == 'enabled' || \ param == 'apply_to' || \ param == 'use_here') -%> <<%= param %>><%= value %>> <% end end -%> <% end end %> <% node["ossec"]["active-response"].each_pair do |command, params| if params["enabled"] == true && \ params["use_here"] == true && \ (node["ossec"]["command"][command]["enabled"] == true && node["ossec"]["command"][command]["use_here"] == true) -%> <%= command %> <% params.each_pair do |param, value| unless (param == 'enabled' || \ param == 'apply_to' || \ param == 'use_here') -%> <<%= param %>><%= value %>> <% end end -%> <% end end -%> <% node["ossec"]["syslog_files"].sort_by {|k,v| k}.each do |logfile,params| if params["use_here"] == true log_format = params["log_format"] || "syslog" -%> <%= log_format %> <%= logfile %> <% params.each_pair do |param,value| unless(param == 'log_format' || \ param == 'apply_to' || param == 'use_here') -%> <<%= param %>><%= value %>> <% end end -%> <% end end -%>