On this page

OSSEC / HIDS Rule 3901

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 3901
  • Definition status: Present in current source
  • Alert message / subject: New courier (imap/pop3) connection.
  • Rule level: 3
  • Definition checked: 2026-10-21

Interpretation and response

This event is recorded as “New courier (imap/pop3) connection.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

This event does not block anything and is not caused by ASL.

This rule simply reports when a courier imap or pop3 connection has occurred. It does not block anything.

Details

This rule is designed to report when an imap or pop3 connection has occurred. It does not block anything and is simply a log message.

ASL merely reports when this occurs. If your pop or imap server is denying access to a user, this rule is not causing it. Please contact your courier server vendor for assistance with this issue.

ASL does not block and will not shun, by default, on these events however if you wish to have ASL shun an IP address on these events please see the Tuning Advice section below.

Disabling this rule will not prevent your imap or pop3 server from reporting access. It will simply “silence” the alert in ASL, however your pop or imap server will continue to record these events. We do not recommend you disable this rule.

Troubleshooting

False Positives

None. This rule does not block anything. ASL merely reports access attempts to courier pop3 or imap servers.

Tuning Guidance

If you wish to shun on these alerts, just set Active Response in the ASL (historical reference) rule manager for rule 3901 to “yes”.

Disabling this rule will not prevent your courier server from logging access events. It will simply “silence” the alert in ASL. Your courier server will continue to log these events. We do not recommend you disable this rule.

If you do not wish to see this alert, just set it to a lower level that the default in the ASL gui. Byt default the level is 3.

This rule also does not send email alerts by default.

Additional Information

Example log messages

Oct 8 11:37:08 plesk3 courier-pop3d: Connection, ip=[::ffff:192.0.2.10]

Source and revision

Migrated from HIDS_3901, wiki page 643, revision 5576 (20151008). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .