Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add HIPAA compliance groups to ruleset #400

Merged
merged 3 commits into from
May 29, 2019
Merged

Add HIPAA compliance groups to ruleset #400

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
62f9b9a
Added script for map the new security standard
AdriiiPRodri May 14, 2019
760e331
Rename input arguments
crd1985 May 15, 2019
021fa44
Add HIPAA groups to ruleset
crd1985 May 15, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 21 additions & 21 deletions rules/0015-ossec_rules.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,39 +20,39 @@
<options>alert_by_email</options>
<match>Agent started</match>
<description>New ossec agent connected.</description>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="502" level="3">
<if_sid>500</if_sid>
<options>alert_by_email</options>
<match>Ossec started</match>
<description>Ossec server started.</description>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="503" level="3">
<if_sid>500</if_sid>
<options>alert_by_email</options>
<match>Agent started</match>
<description>Ossec agent started.</description>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="504" level="3">
<if_sid>500</if_sid>
<options>alert_by_email</options>
<match>Agent disconnected</match>
<description>Ossec agent disconnected.</description>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="505" level="3">
<if_sid>500</if_sid>
<options>alert_by_email</options>
<match>Agent removed</match>
<description>Ossec agent removed.</description>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,pci_dss_10.2.6,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="509" level="0">
Expand Down Expand Up @@ -108,7 +108,7 @@
<match>^Starting vulnerability scan|^Ending vulnerability scan.|</match>
<match>^Starting Azure-logs scan.|^Ending Azure-logs scan.</match>
<description>Ignoring scan messages.</description>
<group>rootcheck,syscheck,pci_dss_10.6.1,gdpr_IV_35.7.d,gdpr_IV_30.1.g,</group>
<group>rootcheck,syscheck,pci_dss_10.6.1,gdpr_IV_35.7.d,gdpr_IV_30.1.g,hipaa_164.312.b,</group>
</rule>

<rule id="516" level="3">
Expand Down Expand Up @@ -143,7 +143,7 @@
<if_sid>500</if_sid>
<match>Duplicated IP</match>
<description>Trying to add an agent with duplicated IP.</description>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>


Expand All @@ -160,7 +160,7 @@
<match>ossec: output: 'df -P': /dev/</match>
<regex>100%</regex>
<description>Partition usage reached 100% (disk space monitor).</description>
<group>low_diskspace,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>low_diskspace,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="532" level="0">
Expand All @@ -174,7 +174,7 @@
<match>ossec: output: 'netstat listening ports</match>
<check_diff />
<description>Listened ports status (netstat) changed (new port opened or closed).</description>
<group>pci_dss_10.2.7,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.2.7,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="534" level="1">
Expand Down Expand Up @@ -204,43 +204,43 @@
<category>ossec</category>
<decoded_as>syscheck_integrity_changed</decoded_as>
<description>Integrity checksum changed.</description>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
</rule>

<rule id="553" level="7">
<category>ossec</category>
<decoded_as>syscheck_deleted</decoded_as>
<description>File deleted.</description>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
</rule>

<rule id="554" level="5">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
</rule>

<rule id="555" level="7">
<if_sid>500</if_sid>
<match>^ossec: agentless: </match>
<description>Integrity checksum for agentless device changed.</description>
<group>syscheck,agentless,pci_dss_11.5,pci_dss_10.6.1,gpg13_4.11,gdpr_II_5.1.f,gdpr_IV_35.7.d,</group>
<group>syscheck,agentless,pci_dss_11.5,pci_dss_10.6.1,gpg13_4.11,gdpr_II_5.1.f,gdpr_IV_35.7.d,hipaa_164.312.c.1,hipaa_164.312.c.2,hipaa_164.312.b,</group>
</rule>

<!-- Hostinfo rules -->
<rule id="580" level="8">
<category>ossec</category>
<decoded_as>hostinfo_modified</decoded_as>
<description>Host information changed.</description>
<group>hostinfo,pci_dss_10.2.7,gpg13_4.13,gdpr_IV_35.7.d,</group>
<group>hostinfo,pci_dss_10.2.7,gpg13_4.13,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="581" level="8">
<category>ossec</category>
<decoded_as>hostinfo_new</decoded_as>
<description>Host information added.</description>
<group>hostinfo,pci_dss_10.2.7,gpg13_4.13,</group>
<group>hostinfo,pci_dss_10.2.7,gpg13_4.13,hipaa_164.312.b,</group>
</rule>


Expand All @@ -249,44 +249,44 @@
<if_sid>500</if_sid>
<match>^ossec: File rotated </match>
<description>Log file rotated.</description>
<group>pci_dss_10.5.2,pci_dss_10.5.5,gpg13_10.1,gdpr_II_5.1.f,gdpr_IV_35.7.d,</group>
<group>pci_dss_10.5.2,pci_dss_10.5.5,gpg13_10.1,gdpr_II_5.1.f,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="592" level="8">
<if_sid>500</if_sid>
<match>^ossec: File size reduced</match>
<description>Log file size reduced.</description>
<group>attacks,pci_dss_10.5.2,pci_dss_11.4,gpg13_10.1,gdpr_IV_35.7.d,</group>
<group>attacks,pci_dss_10.5.2,pci_dss_11.4,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="593" level="9">
<if_sid>500</if_sid>
<match>^ossec: Event log cleared</match>
<description>Microsoft Event log cleared.</description>
<group>logs_cleared,pci_dss_10.5.2,gpg13_10.1,gdpr_II_5.1.f,gdpr_IV_35.7.d,</group>
<group>logs_cleared,pci_dss_10.5.2,gpg13_10.1,gdpr_II_5.1.f,gdpr_IV_35.7.d,hipaa_164.312.b,</group>
</rule>

<rule id="594" level="5">
<category>ossec</category>
<if_sid>550</if_sid>
<hostname>syscheck-registry</hostname>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
<description>Registry Integrity Checksum Changed</description>
</rule>

<rule id="597" level="5">
<category>ossec</category>
<if_sid>553</if_sid>
<hostname>syscheck-registry</hostname>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
<description>Registry Entry Deleted.</description>
</rule>

<rule id="598" level="5">
<category>ossec</category>
<if_sid>554</if_sid>
<hostname>syscheck-registry</hostname>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,</group>
<group>syscheck,pci_dss_11.5,gpg13_4.13,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,</group>
<description>Registry Entry Added to the System</description>
</rule>

Expand Down
Loading