Skip to content

Commit 87d46db

Browse files
annkotsannkots
authored
Merge pull request #156 from annkots/master
Imunify documents updates
2 parents c76e999 + 2af0979 commit 87d46db

File tree

3 files changed

+68
-54
lines changed

3 files changed

+68
-54
lines changed

‎docs/dashboard/README.md‎

Lines changed: 33 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1372,24 +1372,39 @@ Move the slider to change your preferences.
13721372

13731373
There are 15 available levels related to [OSSEC](https://www.ossec.net/docs/manual/rules-decoders/rule-levels.html) and [ModSecurity](https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#severity) severity levels:
13741374

1375-
| | | |
1376-
|-|--|-|
1377-
|Log level | ModSecurity | OSSEC|
1378-
|1 | 7 – <span class="notranslate">DEBUG</span> | 01 – None|
1379-
|2 | 6 – <span class="notranslate">INFO</span> | 02 – System low priority notification|
1380-
|3 | 5 – <span class="notranslate">NOTICE</span> | 03 – Successful/Authorized events|
1381-
|4 | 4 – <span class="notranslate">WARNING</span> | 04 – System low priority error|
1382-
|5 | 4 – <span class="notranslate">WARNING</span> | 05 – User generated error|
1383-
|6 | 3 – <span class="notranslate">ERROR</span> | 06 – Low relevance attack|
1384-
|7 | 3 – <span class="notranslate">ERROR</span> | 07 – “Bad word” matching.|
1385-
|8 | 3 – <span class="notranslate">ERROR</span> | 08 – First time seen|
1386-
|9 | 3 – <span class="notranslate">ERROR</span> | 09 – Error from invalid source|
1387-
|10 | 3 – <span class="notranslate">ERROR</span> | 10 – Multiple user generated errors|
1388-
|11 | 3 – <span class="notranslate">ERROR</span> | 11 – Integrity checking warning|
1389-
|12 | 2 – <span class="notranslate">CRITICAL</span> | 12 – High importancy event|
1390-
|13 | 2 – <span class="notranslate">CRITICAL</span> | 13 – Unusual error (high importance)|
1391-
|14 | 1 – <span class="notranslate">ALERT</span> | 14 – High importance security event.|
1392-
|15 | 0 – <span class="notranslate">EMERGENCY</span> | 15 – Severe attack|
1375+
**OSSEC**
1376+
1377+
| Severity (Level) range | Agent's action | Notes |
1378+
|---|---|---|
1379+
| 0 | Ignored by agent | No action taken |
1380+
| 1 | Ignored by agent | None |
1381+
| 2 | Ignored by agent | System low priority notifications or status messages. No security relevance. |
1382+
| 3 | Just shows in reports | Successful/Authorized events (successful login attempts, firewall allow events, etc.) |
1383+
| 4 | Just shows in reports | System low priority error (related to bad configurations or unused devices/applications). No security relevance, usually caused by default installations or software testing. Default to be seen in Imunify360 UI on the fresh installation. |
1384+
| 5 | Just shows in reports | User generated error (missed passwords, denied actions, etc., no security relevance). Used in [Active Response](/dashboard/#ossec) rules that are blocking specific ports. |
1385+
| 6 | Blocking with greylists | Low relevance attack. They indicate a worm or a virus that have no affect to the system (like code red for Apache servers, etc). They also include frequent IDS events and errors. |
1386+
| 7 | Blocking with greylists | “Bad word” matching. |
1387+
| 8 | Blocking with greylists | Include first time seen events. First time an IDS event is fired or the first time an user logged in. If you just started using OSSEC HIDS, these messages will probably be frequent. |
1388+
| 9 | Blocking with greylists | Error from invalid source. Include attempts to login as an unknown user or from an invalid source. May have security relevance (specially, if repeated). |
1389+
| 10 | Blocking with greylists | Multiple user generated error. They include multiple bad passwords, multiple failed logins, etc. They may indicate an attack or may just be that a user just forgot their credencials. |
1390+
| 11 | Blocking with greylists | Integrity checking warning. Includes messages regarding the modification of binaries or the presence of rootkits (by rootcheck). |
1391+
| 12 | Blocking with greylists | High importancy event. They include error or warning messages from the system, kernel, etc. They may indicate an attack against a specific application. |
1392+
| 13 | Blocking with greylists | Unusual error (high importance). Most of the times, it matches a common attack pattern. |
1393+
| 14 | Blocking with greylists | High importance security event. Most of the times, done with correlation and it indicates an attack. |
1394+
| 15 | Blocking with greylists | Severe attack. No chances of false positives. Immediate attention is necessary. |
1395+
1396+
**ModSecurity**
1397+
1398+
| Severity (Level) range | Incident type | Notes |
1399+
|---|---|---|
1400+
| 7 | <span class="notranslate">DEBUG</span> | Used for monitoring |
1401+
| 6 | <span class="notranslate">INFO</span> | Used for monitoring |
1402+
| 5 | <span class="notranslate">NOTICE</span> | Used for monitoring |
1403+
| 4 | <span class="notranslate">WARNING</span> | Generated by malicious client rules. Used for monitoring. |
1404+
| 3 | <span class="notranslate">ERROR</span> | Mostly generated from outbound leakage rules. Used for greylisting. |
1405+
| 2 | <span class="notranslate">CRITICAL</span> | Generated by the web attack rules. Used for greylisting. |
1406+
| 1 | <span class="notranslate">ALERT</span> | Generated from correlation where there is an inbound attack and an outbound application level error. |
1407+
| 0 | <span class="notranslate">EMERGENCY</span> | Generated from correlation of anomaly scoring data where there is an inbound attack and an outbound leakage. |
13931408

13941409
Autocleanup configuration allows to keep the <span class="notranslate">Incidents</span> page clean by default. The possible settings are as follows:
13951410

‎docs/email/README.md‎

Lines changed: 31 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -7,25 +7,42 @@ Welcome to Imunify Email, a powerful plugin designed to enhance your Imunify360
77
- **Rate-Limit Settings**: Allows you to define how many messages can be sent on behalf of specific accounts, domains, emails, or scripts, helping to prevent abuse and maintain control over email traffic.
88
- **BETA: Incoming Filtration**: A new feature, currently in beta, that can be enabled to protect your users from incoming spam. Learn more about enabling this feature [here](https://docs.imunify360.com/email/#beta-incoming-emails-filtration).
99

10-
### Installation Steps
10+
### System Requirements
1111

12-
:::tip Requirements
13-
- cPanel
14-
- Imunify360
15-
:::
12+
At the moment, Imunify Email runs on the following environments:
1613

17-
1. **Install Imunify360**
14+
**Supported distributions:**
15+
* CentOS 7, 8
16+
* CloudLinux OS 7, 8, 9
17+
* AlmaLinux 8, 9, 10
1818

19-
Imunify Email is a plugin for the Imunify360 product. To use Imunify Email, you must first install Imunify360. Follow the [installation instructions for Imunify360](https://docs.imunify360.com/installation/#installation-instructions) to get started.
19+
**Control panel requirements:**
20+
* cPanel/WHM control panel only
2021

21-
2. **Enable Imunify Email in CLN**
22+
**Software requirements:**
23+
* Hosting administrator only.
24+
* Imunify Email **requires Imunify360** to be installed on the server.
25+
1. **Install Imunify360**:
26+
_Imunify Email is a plugin for the Imunify360 product. To use Imunify Email, you must first install Imunify360. Follow the [installation instructions for Imunify360](https://docs.imunify360.com/installation/#installation-instructions) to get started_.
2227

23-
Once Imunify360 is installed and registered, you can enable the Imunify Email plugin through the CLN (CloudLinux Network) portal. This will automatically install all necessary components. Follow the [instructions to enable Imunify Email in CLN](https://docs.imunify360.com/email/#how-to-enable-imunify-email).
24-
For the system requirements and installation steps, refer to the [Installation](https://docs.imunify360.com/email/#installation).
28+
2. **Enable Imunify Email in CLN**:
29+
_Once Imunify360 is installed and registered, you can enable the Imunify Email plugin through the CLN (CloudLinux Network) portal. This will automatically install all necessary components. Follow the [instructions to enable Imunify Email in CLN](https://docs.imunify360.com/email/#how-to-enable-imunify-email). For the system requirements and installation steps, refer to the [Installation](https://docs.imunify360.com/email/#installation)_.
2530

26-
## Full Documentation
31+
**Minimum system requirements for installation**:
32+
* x64
33+
* 512 Mb
34+
* 20 Gb disk space
35+
36+
:::tip Note
37+
- Imunify Email RAM consumption depends on the mail traffic. In a waiting state it consumes little RAM; however, for scanning large mails temporary increase of RAM consumption can be observed.
38+
- Used disk space depends on the number of accounts on a server. By default, each account will have 100 MB limitation for quarantine space. This limit can be adjusted using the UI later.
39+
:::
40+
41+
:::warning
42+
Ensure that **port 11335 is open**. Additionally, note that it is a UDP server, and therefore, it is not accessible via telnet.
43+
:::
2744

28-
#### Imunify Email compatibility
45+
### Imunify Email compatibility
2946

3047
Imunify Email has been checked for compatibility with following tools and mail gateways:
3148

@@ -36,32 +53,10 @@ Imunify Email has been checked for compatibility with following tools and mail g
3653
* SpamAssassin (incoming and outgoing configuration)
3754
* [Smtp2go](https://www.smtp2go.com/)
3855

39-
### Installation
40-
41-
:::danger Note
42-
Hosting administrator only.
43-
Imunify Email requires Imunify360 to be installed on the server.
44-
:::
4556

46-
:::warning
47-
Ensure that port 11335 is open. Additionally, note that it is a UDP server, and therefore, it is not accessible via telnet.
48-
:::
49-
50-
Imunify Email is simple to install. At the moment, it runs on the following distributions:
51-
52-
* CentOS 7, 8 with support of cPanel/WHM control panel.
53-
* CloudLinux OS 7, 8, 9 with support of cPanel/WHM control panel.
54-
* AlmaLinux 8, 9, 10 with support of cPanel/WHM control panel.
55-
56-
Minimum system requirements for installation:
57-
58-
**x64 | 512 Mb | 20 Gb disk space**
59-
60-
:::tip Note
61-
- Imunify Email RAM consumption depends on the mail traffic. In a waiting state it consumes little RAM, however for scanning large mails temporary increase of RAM consumption can be observed.
57+
## Full Documentation
6258

63-
- Used disk space depends on the number of accounts on a server. By default, each account will have 100 MB limitation for quarantine space. This limit can be adjusted using UI later.
64-
:::
59+
### Installation
6560

6661
To install Imunify Email, you need to enable the corresponding option in your CLN account. After that the product will be installed automatically
6762
within 24 hours. To install it immediately you can use on of the following command as root user:

‎docs/features/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -775,6 +775,10 @@ Below is an example of the **INCORRECT** assumption of the config loading order:
775775
```
776776
:::
777777

778+
:::danger Upon the config changes, no Imunify services restart is needed.
779+
You may verify the changes in `/etc/sysconfig/imunify360/imunify360-merged.config`.
780+
:::
781+
778782
This way you can keep your local customizations, and still be able to rollout your main config.
779783

780784
The following CLI command can be used to check current server configuration:

0 commit comments

Comments
 (0)