I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion.
zcat /var/log/*.gz | /var/ossec/bin/ossec-logtest
Secondly it will automatically run the
syscheck and store
/var/ossec/queue/syscheck/ . Is there anything else I need to configure for me to start working with OSSEC ?