If your system is compromised, you can't trust the OSSEC logs or any other logs generated from that machine. OSSEC is good for detecting new intrusions through log analysis. The command you give is used to detect which OSSEC rule will match the given log. So you are piping all the log files to the ossec-logtest utility and finding out if something matches then you are assuming that the system is already compromised. However, the first step an attack do is to clear all the log entries in order to cover his tracks. That is why OSSEC won't help there.
To your question what steps you need, decide which log files you are going to monitor and add the log file entries in the ossec.conf (or agent.conf) file. If you want to monitor certain files/directories for change, you can do that as well. If you have some custom log files that is not parsed by OSSEC out of the box (you can check it through the ossec-logtest), then write custom decoder in the local_decoder.xml. Don't put your decoder in the decoder.xml file because if you update your agent, it will be lost.
As a last step if you have a centralized log server, then configure the OSSEC manager to forward all the alerts to the central log server by specifying the IP address in the ossec.conf on the manager side.
Edit: For website security, there are some very good posts by Tony Parez:
OSSEC for Website Security Part I
OSSEC - Detecting New Files - Understanding How it Works