Rules and Decoders

• Testing OSSEC rules/decoders
  • Testing using ossec-logtest
• CDB List lookups from within Rules
  • Use cases
  • Syntax for Lists
• Create Custom decoder and rules
  • Add the log files you want to monitor to ossec.conf
  • Create a custom decoder
  • Write custom rules
• Directory path loading of rules and decoders
  • Use case
  • Details