On this page

OSSEC / HIDS Rule 300061

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 300061
  • Definition status: Historical / version-dependent
  • Alert message / subject: WAF anti-spam log integration

This ID was not found in the reviewed main HIDS rules directory. It may belong to an older release or a generated integration. Check your installed rule bundle before applying its guidance.

Interpretation and response

This historical HIDS integration recognizes logged WAF events about pharmacy or drug-related content. It processes a WAF log event; it is not the ModSecurity request-filtering rule itself.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

The HIDS bundle build generates WAF-to-HIDS integration definitions separately. A historical generated example exists, but this ID is absent from the main HIDS rules directory. Confirm the installed generated bundle. See the separate WAF rule 300061 documentation for request filtering.

Documentation

This article preserves historical OSSEC/HIDS guidance. This ID was not found in the current main rule directory; the historical status, response defaults and product instructions do not establish its behavior in a current deployment.

Description

Atomicorp.com WAF AntiSpam Rules: Possible Spam or Restricted content: Pharmacy and/or Drug content detected

What you should do

No actions required

Troubleshooting

False Positives

A legitimate event may still trigger this rule. Review the surrounding activity before deciding whether it is malicious.

Tuning Guidance

There is no guidance for tuning this rule, this is a generic event and the rule should not be disabled.

Additional Information

Support

If you are unsure about how to respond to this alert, please contact Atomicorp support. We’re here to help you!

Source and revision

Migrated from HIDS_300061, wiki page 913, revision 6279 (20201023). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .