OSSEC Documentation

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, Mac OS X, Solaris and Windows. A list with all supported platforms is available at: Supported Systems

Note

OSSEC+ extends OSSEC with additional capabilities such as ELK integration, community threat sharing, and machine learning. Registration is free.

Getting Started

• Getting started with OSSEC
  • Key Benefits
  • Key Features
• OSSEC Architecture
  • Manager (or Server)
  • Agents
  • Agentless
  • Virtualization/VMware
  • Firewalls, switches and routers
• Supported Systems
  • Operating Systems
  • Devices supported via Syslog
  • Devices and Operating Systems via Agentless

Manual

• Manual
  • Getting started with OSSEC
  • OSSEC Architecture
  • Supported Systems
  • Installation
  • Agents
  • Log monitoring/analysis
  • Syscheck
  • Rootcheck Manual
  • Rules and Decoders
  • Output and Alert options
  • Active Response
  • Misc. Notes

Reference

• Syntax and Options
  • Regular Expression Syntax
  • Log Analysis Syntax: Rules and Decoders
  • ossec.conf: syntax and options
  • agent.conf
  • internal_options.conf: syntax and options
• Man pages
  • agent-auth
  • agent_control
  • clear_stats
  • list_agents
  • manage_agents
  • ossec-agentd
  • ossec-agentlessd
  • ossec-analysisd
  • ossec-authd
  • ossec-control
  • ossec-csyslogd
  • ossec-dbd
  • ossec-execd
  • ossec-logcollector
  • ossec-logtest
  • ossec-maild
  • ossec-makelists
  • ossec-monitord
  • ossec-regex
  • ossec-regex-convert
  • ossec-remoted
  • ossec-reportd
  • ossec-syscheckd
  • rootcheck_control
  • syscheck_control
  • syscheck_update
  • util.sh
  • verify-agent-conf
• Output Formats
  • OSSEC alert log samples
  • JSON Format
  • cef log format:
• Examples
  • Output
• Log Samples
  • Apache Logs
  • GNU Radius
  • Windows Routing and Remote Access logs
  • Log Samples from Pam
  • Log Samples from sshd
  • Su log samples
  • Messages from useradd, userdel, etc
  • Linux Logs
  • Windows Logs
  • Log Samples from BSD systems
  • Log entries in asl.log on OSX
  • OS X IPFW Log Samples
  • Log samples Mac
  • FTP Logs
  • Nessus scan in a web server log
  • Misc. Logs
  • Cisco Logs
  • Log Samples for MySQL
  • Log Samples for PostgreSQL
  • Log Samples from PHP
  • Urlscan Log samples
  • Log Samples from Named
  • Log samples for Checkpoint
  • Log Samples from iptables
  • Microsoft ISA Server
  • Log Samples from the Netscreen Firewall
  • Log samples from PF
  • Log Samples from SonicWall
  • Samples for the Windows firewall
  • WIPFW
  • Zone Alarm (free version) Log samples
  • Courier Log samples
  • Dovecot log samples
  • Exchange Log Samples
  • Log Samples from Exim
  • Log Samples from imapd
  • Log Samples for postfix
  • Log Samples from Sendmail
  • Log Samples for VM-POP3d
  • Log Samples from vpopmail
  • Log Samples for VMware ESX
  • Web Scan sample 2

Release Notes

• 3.5

FAQ & Cookbooks

• Frequently asked questions
  • Active response
  • Agents: FAQ
  • Alerts: FAQ
  • Installation: FAQ
  • Miscellaneous: FAQ
  • OSSEC: FAQ
  • Syscheck: FAQ
  • When the unexpected happens: FAQ
• User submitted Cookbooks
  • How to restart an agent after changes to the agent.conf:
  • Using filebeat, logstash, and elasticsearch:

Development

• Build, compile, and not much more
  • install.sh
  • Makefile
  • test-rules:
• OSSEC PGP/GPG keys
  • Verify a release tarball
  • Maintainer keys
• oRFC:
  • oRFC: 1 The Collective Code Construction Contract (C4)
  • oRFC: 2 Coding Style Guide
• Documentation maintenance
  • Config audit checklist
• About & Contributing
  • OSSEC Processes and Data
  • Active-response Internal Logic Flow
  • How to start helping with the project?
  • Languages and respective translators for the installation

Indices and tables

• Index

• Module Index

• Search Page