yes foo@bar.org mail.bar.org ossec@bar.org 3600 no yes /etc,/usr/bin,/usr/sbin /bin,/sbin /etc/mtab /etc/mnttab /etc/hosts.deny /etc/mail/statistics /etc/random-seed /etc/adjtime /etc/httpd/logs /etc/utmpx /etc/wtmpx /etc/cups/certs /var/ossec/etc/shared/rootkit_files.txt /var/ossec/etc/shared/rootkit_trojans.txt 127.0.0.1 ^localhost.localdomain$ 127.0.0.1 10.1.1.0/8 syslog secure 1 7 foo@bar.com 100100 host-deny host-deny.sh srcip yes firewall-drop firewall-drop.sh srcip yes disable-account disable-account.sh user yes host-deny all 6 43200 firewall-drop all 6 43200 syslog /var/log/messages rules_config.xml pam_rules.xml sshd_rules.xml telnetd_rules.xml syslog_rules.xml arpwatch_rules.xml symantec-av_rules.xml pix_rules.xml named_rules.xml smbd_rules.xml vsftpd_rules.xml pure-ftpd_rules.xml proftpd_rules.xml ms_ftpd_rules.xml hordeimp_rules.xml vpopmail_rules.xml web_rules.xml apache_rules.xml ids_rules.xml squid_rules.xml firewall_rules.xml netscreenfw_rules.xml postfix_rules.xml sendmail_rules.xml imapd_rules.xml mailscanner_rules.xml ms-exchange_rules.xml racoon_rules.xml vpn_concentrator_rules.xml spamd_rules.xml msauth_rules.xml attack_rules.xml zeus_rules.xml ossec_rules.xml local_rules.xml