From OSSEC Wiki
How to enable Picviz Support?
As of now, you need Picviz SVN to make it work and keep in mind that it is experimental.
In the OSSEC configuration file, Picviz support can be activated like this:
<picviz_output>yes</picviz_output> <picviz_socket>/var/ossec/picviz.socket</picviz_socket>
On picviz side, an OSSEC template is available in the template directory and Picviz should be run like this:
$ pcv -Tpngcairo -o ossec.png -s /var/ossec/picviz.socket -t templates/ossec.pgdt -a