OSSEC / HIDS Rule 31151

OSSEC / HIDS rule catalog

• Rule family: OSSEC / HIDS
• Rule ID: 31151
• Definition status: Historical / version-dependent
• Alert message / subject: Multiple web server 4xx errors

This ID was not found in the reviewed main HIDS rules directory. It may belong to an older release or a generated integration. Check your installed rule bundle before applying its guidance.

Interpretation and response

Historical rule 31151 correlates HTTP 4xx client-error responses from the same source. Repeated 404 responses can therefore be relevant; they may indicate scanning, broken links or a misconfigured client.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

The historical base rule 31101 matches the 4xx status class. The wording “400 error codes” was broader than literal HTTP 400. Rule 31151 is absent from the current Atomicorp main HIDS inventory; its older definition is retained in the OSSEC source tree. A 404 example does not prove blocking.

Documentation

This article preserves historical OSSEC/HIDS guidance. This ID was not found in the current main rule directory; the historical status, response defaults and product instructions do not establish its behavior in a current deployment.

Abstract:

Historical rule 31151 correlates repeated HTTP 4xx responses from the same source. Its parent rule 31101 accepts the 4xx class, so the original 404 examples were consistent with the implementation even though the alert text said “400 error codes.”

Repeated errors can indicate scanning or exploitation attempts, but also broken links and client misconfiguration. This is historical behavior; verify the installed release and correlation settings.

Example Alert

Illustrative event summary (not a captured log): repeated HTTP 404 responses to a missing resource from a single source, correlated by OSSEC rule 31151. Neither a 404 response nor this alert establishes that an attack was blocked.

Recommended Actions:

Inspect requested resources and expected client behavior, then verify any configured Active Response separately. The wiki’s unconditional claim that the attack was blocked has been corrected.

Source and revision

Migrated from OSSEC_Rule:_31151, wiki page 30, revision 78 (20070528). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .