I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC configuration for web application security i.e. folders,logs to monitor for intrusion detection?
For intrusion detection you will definitely want to monitor your access.log and error.log files for this web app. I would look out for:
Unusually high traffic. Figure out what a normal amount of traffic is based on your access.log and set a monitor to alert you if you suddenly get a much greater amount (e.g. 10 times more requests) that could indicate either a DoS attack or server probing.
A large amount of POST requests. This usually indicates a SQL injection attack.
Many lines in your error.log file. Again this probably indicates server probing (or something misconfigured).
Others please feel free to add/edit.