Rule modification feature

[3DRaven]

Rule modification feature

[jasonish]

At this time there is no such way to do this. The idea of defining user actions that result in a script being run is interesting. Would just have to resolve where that script should be run to get the desired action. Long term I imagine some rule editing capabilities. But for now, I'm sorry to say EveBox can't do this. But you do have me thinking about it a little harder.

[3DRaven]

Hi. Thank you for reply. I mean predefined script on evebox run users home dir. It is not custamizable from UI script of course, it is not secure. Just button on UI which just runing predefined script.sh and send to it alert parameters, as example attacker IP.

[3DRaven]

It is sad, I try to find method to block atacker from simple UI.

[jasonish]

Yeah, I hear you. I'm kind of a brainstorming with myself user defined server side actions. So that would be a user define script that is passed enough information to do something useful, even if that means the user scripts uses ssh, ansible, etc. to execute something on a remote host.