Invalid state and untracked packet iptables issues.

[dolanjs]

For the Monitor servers smtp traffic and (app and monitor servers) tor traffic keep experiencing issues with iptables state table. Even thought there are fw rules to allow outbound NEW,ESTABLISHED,RELATED and the corresponding inbound ESTABLISHED,RELATED for SMTP and Tor traffic, various INVALID and UNTRACKED events are being dropped. The sequence of events dropped packets:

Jan 23 16:01:51 mon-staging kernel: [39702.413350] Denied_INVALID IN= OUT=eth0 SRC=10.0.2.15 DST=74.125.20.108 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=55750 DF PROTO=TCP SPT=49706 DPT=587 WINDOW=32160 RES=0x00 ACK URGP=0 
Jan 23 16:01:51 mon-staging kernel: [39702.413475] Denied_ACK IN= OUT=eth0 SRC=10.0.2.15 DST=74.125.20.108 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=55750 DF PROTO=TCP SPT=49706 DPT=587 WINDOW=32160 RES=0x00 ACK URGP=0 
Jan 23 16:01:51 mon-staging kernel: [39702.413350] Denied_TCP IN= OUT=eth0 SRC=10.0.2.15 DST=74.125.20.108 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=55750 DF PROTO=TCP SPT=49706 DPT=587 WINDOW=32160 RES=0x00 ACK URGP=0 

This is causing a lot of false positives. Until the issue can be fully diagnosed we should not log OUTBOUND host based FW drops. Even though this could mean that an IOC is not logged compared to the amount of false positives logging them currently generates I think it is worth the trade off.

Related to #836

[garrettr]

Fyi: IOC = indicator of compromise

[garrettr]

@dolanjs Can you provided a detailed STR for future investigators?

[eloquence]

Closing as stale; since the OSSEC spam issue is resolved, we'd need clear STR for any remaining issues with log spam.