Listened ports status (netstat) changed (new port opened or closed).

Description

match="ossec: output: 'netstat listening ports"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 500 Grouping of wazuh rules. anchor level 0
   decoded_as=ossec
2. 530 Wazuh process monitoring rules. anchor level 0
   match="^ossec: output:"
3. 533 Listened ports status (netstat) changed (new port opened or closed). refinement level 7 this rule
   match="ossec: output: 'netstat listening ports"

Rule dependencies

Depends on

• composes · Wazuh if_sid 530
  • Wazuh process monitoring rules.