Skip to main content

Questions tagged [ossec]

OSSEC is a free, open-source host-based intrusion detection system (HIDS).

Filter by
Sorted by
Tagged with
0 votes
1 answer
458 views

Monitor logs managed by Wazuh and OSSEC

Today I use OSSEC as HIDS, but reading Wazuh's site it seems to be more modern and has more resources. I saw that it has an Elastic Stack integration, something I don't interested about due to using ...
Tom's user avatar
  • 174
0 votes
1 answer
356 views

OSSEC Rules Group Explanation

I am new to OSSEC and Cyber Security in general and would like to understand it a bit better. OSSEC provides so called "Rules Groups" alerts get assigned to and I would like to understand ...
0xDr0id's user avatar
  • 111
1 vote
0 answers
213 views

Help in understnading HIDS OSSEC traces

I realized my system Ubuntu and windows dual boot might have been compromised. So, I installed OSSEC HIDS to try to look for issues. When I ran dmesg, i found the following trace: ------------[ cut ...
dawn's user avatar
  • 111
2 votes
0 answers
497 views

How do I create exceptions on Wazuh (OSSEC)?

I currently have a setup with OSSEC and AIDE running on our servers. We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log. I want to make an exception for ...
Thiago Escobar's user avatar
1 vote
2 answers
2k views

Windows process documentation for tuning Sysmon

I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
synthesis's user avatar
  • 155
1 vote
1 answer
2k views

AIDE and OSSEC conflicts?

Being fairly new to both AIDE and OSSEC I've been trying to find out if there are any potential conflicts in having them both installed on one host (CentOS 7.5). It seems like they could work as a ...
jfran3's user avatar
  • 151
1 vote
1 answer
834 views

How different are Lynis and Wazuh solutions? [closed]

It seems both Cisofy's Lynis and Wazuh's OSSEC share a lot of functionalities. I'm completely newbie on both tools and yet I need to pick one (or both) to help achieve PCI DSS Compliance. Any thoughts?...
Igor Gatis's user avatar
1 vote
1 answer
942 views

Why won't ossec block SSH connections when it seems to be configured correctly?

Why won't ossec block connections from another server? I installed ossec version 2.9.3 on Ubuntu 16.04. In the ossec.conf file I have these lines where x.x.x.x is the IP address of a second Linux ...
Jermoe's user avatar
  • 11
3 votes
2 answers
637 views

OSSEC capabilities for handle a virus that already spread into the deepest system

As far as I know, OSSEC is a Open Source HIDS. It's a "Detection System". I read in journals, it collect logs and flag any anomaly that had been found in a system ( e.g. Debian Server ) and do some ...
gagantous's user avatar
  • 193
1 vote
0 answers
353 views

Identifying privilege escalation in OSSEC logs [closed]

I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
qwerty's user avatar
  • 111
1 vote
1 answer
1k views

OSSEC - Can i centralize what file to check with centralized agent config?

I am starting with OSSEC for file integrity check in a bunch of Windows servers and CentOS. And I would like to keep a centralized configuration of what to check for all my agents, based on they OS. ...
JuliaVI's user avatar
  • 13