Very true. In that case, send it over/via OSSEC in an encrypted package? I dunno...But the basic principle is useful - knowing "what" was changed, not just that it was changed.
David Vasil wrote:
Forrest Aldrich wrote:Maybe for text-only files, provide an option to include a contextual diff output, which shows the changes of the monitored file, with that of the known version --- this would require keeping that old version archived somewhere, though. Hmm... may be useful in some situations, knowing not only that the file was changed, but WHAT was changed.That could come back and bite you in some situations where the file that was changed contained sensitive information (which upon alert would be sent to you through clear-text email).