another system security consideration is the potential for abuse of active responses. for example, how might an attacker cause denial of service, preventing client1 from accessing the web server, just by causing some non-privileged program to run on client1? or consider the case of an attacker having non-privileged access to client1 who would like ten minutes of unobserved interaction with client1? if client1 were the source of numerous failed ssh attempts to the ossec server itself, what would be the result?
