Rules should be in the form: | alert_level;path;recusive_if_directory;comment_or_description |
|
alert_level | Options:
red , yellow , or IGNORE The level of alert that will be generated if this file/directory is modified. ( IGNORE allows you to specify files that shall be excluded from previously defined directory checks ) |
|
path | The path to the file or directory you wish to monitor. This can now also be a URL to a http protocol webpage (no https support). ie: /etc/hosts or http://www.yahoo.com/index.html |
|
recursive_if_directory | Options: 1 or 0 If this path is a directory, "1" here will cause the directory to be recursed so that all subdirectories will be checked. "0" means that only the files within this directory should be checked. |
|
comment_or_description | Optional comment or description that will appear if this file/directory is modified. (ie: "System Configuration Files") |
All invalid rules will be ignored. |
|
File Integrity Check Rules for Sensor: [SID] - [HOSTNAME] | |
|
|