Skip to content

Commit

Permalink
Add HIPAA groups to ruleset
Browse files Browse the repository at this point in the history
  • Loading branch information
@crd1985
crd1985 committed May 15, 2019
1 parent 760e331 commit 021fa44
Show file tree
Hide file tree
Showing 82 changed files with 1,014 additions and 1,014 deletions.
42 changes: 21 additions & 21 deletions rules/0015-ossec_rules.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,39 +20,39 @@
<options>alert_by_email</options>
<match>Agent started</match>
<description>New ossec agent connected.</description>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="502" level="3">
<if_sid>500</if_sid>
<options>alert_by_email</options>
<match>Ossec started</match>
<description>Ossec server started.</description>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="503" level="3">
<if_sid>500</if_sid>
<options>alert_by_email</options>
<match>Agent started</match>
<description>Ossec agent started.</description>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="504" level="3">
<if_sid>500</if_sid>
<options>alert_by_email</options>
<match>Agent disconnected</match>
<description>Ossec agent disconnected.</description>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="505" level="3">
<if_sid>500</if_sid>
<options>alert_by_email</options>
<match>Agent removed</match>
<description>Ossec agent removed.</description>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="509" level="0">
Expand Down Expand Up @@ -108,7 +108,7 @@
<match>^Starting vulnerability scan|^Ending vulnerability scan.|</match>
<match>^Starting Azure-logs scan.|^Ending Azure-logs scan.</match>
<description>Ignoring scan messages.</description>
<group>rootcheck,syscheck,pci_dss_10.6.1,gdpr_IV_35.7.d,gdpr_IV_30.1.g,</group>
<group>rootcheck,syscheck,pci_dss_10.6.1,gdpr_IV_35.7.d,gdpr_IV_30.1.g,hipaa_164.312.b,</group>
</rule>

<rule id="516" level="3">
Expand Down Expand Up @@ -143,7 +143,7 @@
<if_sid>500</if_sid>
<match>Duplicated IP</match>
<description>Trying to add an agent with duplicated IP.</description>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>


Expand All @@ -160,7 +160,7 @@
<match>ossec: output: 'df -P': /dev/</match>
<regex>100%</regex>
<description>Partition usage reached 100% (disk space monitor).</description>
<group>low_diskspace,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>low_diskspace,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="532" level="0">
Expand All @@ -174,7 +174,7 @@
<match>ossec: output: 'netstat listening ports</match>
<check_diff />
<description>Listened ports status (netstat) changed (new port opened or closed).</description>
<group>pci_dss_10.2.7,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.2.7,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="534" level="1">
Expand Down Expand Up @@ -204,43 +204,43 @@
<category>ossec</category>
<decoded_as>syscheck_integrity_changed</decoded_as>
<description>Integrity checksum changed.</description>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
</rule>

<rule id="553" level="7">
<category>ossec</category>
<decoded_as>syscheck_deleted</decoded_as>
<description>File deleted.</description>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
</rule>

<rule id="554" level="5">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
</rule>

<rule id="555" level="7">
<if_sid>500</if_sid>
<match>^ossec: agentless: </match>
<description>Integrity checksum for agentless device changed.</description>
<group>syscheck,agentless,pci_dss_11.5,pci_dss_10.6.1,gpg13_4.11,gdpr_II_5.1.f,gdpr_IV_35.7.d,</group>
<group>syscheck,agentless,pci_dss_11.5,pci_dss_10.6.1,gpg13_4.11,gdpr_II_5.1.f,gdpr_IV_35.7.d,hipaa_164.312.c.1,hipaa_164.312.c.2,hipaa_164.312.b,</group>
</rule>

<!-- Hostinfo rules -->
<rule id="580" level="8">
<category>ossec</category>
<decoded_as>hostinfo_modified</decoded_as>
<description>Host information changed.</description>
<group>hostinfo,pci_dss_10.2.7,gpg13_4.13,gdpr_IV_35.7.d,</group>
<group>hostinfo,pci_dss_10.2.7,gpg13_4.13,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="581" level="8">
<category>ossec</category>
<decoded_as>hostinfo_new</decoded_as>
<description>Host information added.</description>
<group>hostinfo,pci_dss_10.2.7,gpg13_4.13,</group>
<group>hostinfo,pci_dss_10.2.7,gpg13_4.13,hipaa_164.312.b,</group>
</rule>


Expand All @@ -249,44 +249,44 @@
<if_sid>500</if_sid>
<match>^ossec: File rotated </match>
<description>Log file rotated.</description>
<group>pci_dss_10.5.2,pci_dss_10.5.5,gpg13_10.1,gdpr_II_5.1.f,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.5.2,pci_dss_10.5.5,gpg13_10.1,gdpr_II_5.1.f,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="592" level="8">
<if_sid>500</if_sid>
<match>^ossec: File size reduced</match>
<description>Log file size reduced.</description>
<group>attacks,pci_dss_10.5.2,pci_dss_11.4,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>attacks,pci_dss_10.5.2,pci_dss_11.4,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="593" level="9">
<if_sid>500</if_sid>
<match>^ossec: Event log cleared</match>
<description>Microsoft Event log cleared.</description>
<group>logs_cleared,pci_dss_10.5.2,gpg13_10.1,gdpr_II_5.1.f,gdpr_IV_35.7.d,</group>
<group>logs_cleared,pci_dss_10.5.2,gpg13_10.1,gdpr_II_5.1.f,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="594" level="5">
<category>ossec</category>
<if_sid>550</if_sid>
<hostname>syscheck-registry</hostname>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
<description>Registry Integrity Checksum Changed</description>
</rule>

<rule id="597" level="5">
<category>ossec</category>
<if_sid>553</if_sid>
<hostname>syscheck-registry</hostname>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
<description>Registry Entry Deleted.</description>
</rule>

<rule id="598" level="5">
<category>ossec</category>
<if_sid>554</if_sid>
<hostname>syscheck-registry</hostname>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
<description>Registry Entry Added to the System</description>
</rule>

Expand Down
Loading

0 comments on commit 021fa44

Please sign in to comment.