Okay, so we've created a granular rule for changes to the preload file,
but how do we trigger a remediation script when this rule fires?
For this,
we're going to go into the ossec.conf and create an active‑response command.
Okay, let's go to our first active‑response configuration.
Here we define the command that we're going to trigger.
In our case, this is a script I made for this tutorial,
deny‑invisible‑process.py.
As we can see in the SUMMARY, this script runs the unhide command.
Unhide just looks for hidden processes.
If a process is found, our script will kill the process.
Within the executable tag, we specify what script we're going to execute.
Active‑response commands expect the script to be within the bin directory.
After we define the command, we need to map the command to a rule.
We do this within the active‑response section.
As you can tell,
we declare the command within the command tag. The location
command declares where the script is executed.
In our case,
we want the script to execute on the host where the alert was generated,
in other words, the Victim container, so we declare local here.
To see what other location options are available,
please see course notes number 13.
Rules_id is our trigger rule, so in this case,
changes to the preload file, which is rule 100,000,
would trigger our deny‑invisible‑process command.
As an aside, if you'd like to see the actual script,
please see course notes number 14.