Active Response

The Active Response feature within OSSEC can run applications on an agent or server in response to certain triggers. These triggers can be specific alerts, alert levels, or rule groups.

The active response framework is also what allows an OSSEC administrator to start a syscheck scan or restart OSSEC on a remote agent.

• Creating Customized Active Responses
  • Creating the command
  • Configure the Active response
  • Create active response script
  • Restart OSSEC and test
• UNIX: Active Response Configuration
  • Commands Configuration
  • Responses Configuration
  • Active Response Tools
• Windows: Active Response Configuration
• Understanding Active Response with FreeBSD
  • How does OSSEC know which firewall is being used?
  • How do I change which script is used by an agent?