{"action":"created","issue":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/603","labels_url":"https://api.github.com/repos/ossec/ossec-hids/issues/603/labels{/name}","comments_url":"https://api.github.com/repos/ossec/ossec-hids/issues/603/comments","events_url":"https://api.github.com/repos/ossec/ossec-hids/issues/603/events","html_url":"https://github.com/ossec/ossec-hids/issues/603","id":72174887,"number":603,"title":"sid 5402 incorrectly alerts for less than 3 failed attempts","user":{"login":"mikedowney01","id":3897105,"avatar_url":"https://avatars.githubusercontent.com/u/3897105?v=3","gravatar_id":"","url":"https://api.github.com/users/mikedowney01","html_url":"https://github.com/mikedowney01","followers_url":"https://api.github.com/users/mikedowney01/followers","following_url":"https://api.github.com/users/mikedowney01/following{/other_user}","gists_url":"https://api.github.com/users/mikedowney01/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedowney01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedowney01/subscriptions","organizations_url":"https://api.github.com/users/mikedowney01/orgs","repos_url":"https://api.github.com/users/mikedowney01/repos","events_url":"https://api.github.com/users/mikedowney01/events{/privacy}","received_events_url":"https://api.github.com/users/mikedowney01/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-04-30T14:14:16Z","updated_at":"2015-05-08T17:05:17Z","closed_at":null,"body":"When running sudo, if a user fails to authenticate only once or twice and exits without attempting authentication again, sid 5402 will incorrectly alert that \"Successful sudo to ROOT executed\". This does not alert for 3 failed attempts, due to sid 5401 matching first. Matching \"incorrect password attempt\" will solve this problem. I would be more than happy to submit a pull request, but I'm not sure if the better solution would be to edit rule 5401 so that it alerts for any number of incorrect password attempts, or to add another rule before 5402, changing it's sid to 5403 and potentially causing issues with local_rules."},"comment":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/comments/100299875","html_url":"https://github.com/ossec/ossec-hids/issues/603#issuecomment-100299875","issue_url":"https://api.github.com/repos/ossec/ossec-hids/issues/603","id":100299875,"user":{"login":"mikedowney01","id":3897105,"avatar_url":"https://avatars.githubusercontent.com/u/3897105?v=3","gravatar_id":"","url":"https://api.github.com/users/mikedowney01","html_url":"https://github.com/mikedowney01","followers_url":"https://api.github.com/users/mikedowney01/followers","following_url":"https://api.github.com/users/mikedowney01/following{/other_user}","gists_url":"https://api.github.com/users/mikedowney01/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedowney01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedowney01/subscriptions","organizations_url":"https://api.github.com/users/mikedowney01/orgs","repos_url":"https://api.github.com/users/mikedowney01/repos","events_url":"https://api.github.com/users/mikedowney01/events{/privacy}","received_events_url":"https://api.github.com/users/mikedowney01/received_events","type":"User","site_admin":false},"created_at":"2015-05-08T17:05:17Z","updated_at":"2015-05-08T17:05:17Z","body":"I think you're right. The referenced pull request will take care of the problem. I kept the old rule pretty much the same, just changed the sid and added an <if_sid> for the new 5401. I think it's important to keep this rule as is, instead of matching for three instances of 5401. The reason being that 3 failed sudo attempts will only generate one log, which this rule is matching with \"3 incorrect password attempts\"."}}