Manual

• Getting started with OSSEC
  • Key Benefits
  • Key Features
• OSSEC Architecture
  • Manager (or Server)
  • Agents
  • Agentless
  • Virtualization/VMware
  • Firewalls, switches and routers
• Supported Systems
  • Operating Systems
  • Devices supported via Syslog
  • Devices and Operating Systems via Agentless
• Installation
  • Installation requirements
  • Manager/Agent Installation
  • Manual Installation
  • Verify the tarball signature
  • Windows Agent Installation
  • Package Installation
  • Compiling OSSEC for a Binary Installation
  • Server Virtual Appliance Installation
  • Unattended Source Installation
  • Compiling the OSSEC Windows Agent on Windows
  • Requirements
  • Compilation
  • Integration and Deployment with cfengine
  • OSSEC Updates
  • Upgrading to OSSEC 4.x
  • systemd deployment
• Agents
  • Communication between agents and the OSSEC server
  • Managing Agents
  • Agent systems behind NAT or with dynamic IPs (DHCP)
  • Adding an agent with ossec-authd
  • Centralized agent configuration
  • Remoted architecture and tuning
  • Agentless Monitoring
  • Writing Agentless Scripts
• Log monitoring/analysis
  • What is log analysis?
  • Quick Facts
  • Configuration Options
  • Monitoring logs
• Syscheck
  • Why Integrity checking?
  • Quick facts
  • Realtime options
  • Configuration options
  • Configuration Examples
  • Real time Monitoring
  • Report Changes
  • MD5 whitelist database
  • Syscheck: FAQ
  • See also
• Rootcheck Manual
  • Rootcheck
  • Understanding the Unix policy auditing on OSSEC
• Rules and Decoders
  • Testing OSSEC rules/decoders
  • CDB List lookups from within Rules
  • Create Custom decoder and rules
  • Directory path loading of rules and decoders
  • Rules Classification
  • Rules Group
  • How OSSEC matches rules
• Output and Alert options
  • Contents:
  • Overview:
• Active Response
  • Disabling active response
• Misc. Notes
  • AES Encryption Support
  • Why am I getting multiple 675 events from AD + Samba?
  • Agentless Scripts
  • Periodic diff Specification
  • Periodic Specification
  • Example of real FWD: command.
  • Configuring Checkpoint
  • How do I use or create my own compiled rules?
  • Correlating multiple snort IDS with ossec
  • Creating Customized Active Responses
  • Question: How does the decoder.xml relate to the rules?
  • Disconnected Agent Alert
  • Additional rules
  • Why is OSSEC not seeing my iptables messages?
  • Log Checksums
  • Manager backup and migration
  • How to add multiple log files to be monitored?
  • Nmap correlation
  • How to set up Syslog output
  • How to configure PIX and OSSEC
  • Detecting portscans with OSSEC and iplog
  • Rule Groups
  • How to configure ossec to never block some IPs in the active response
  • SELinux and logrotate for OSSEC logs