Collaborate Disseminate
I have a webserver and mailserver that I use for fun/learning/breaking. There is only one user who should be logging in; me.
I notice in the postfix logs and HIDS alerts I get a lot of SASL failures from a particular subnet (only last octe… Continue reading How to find out what the subnet is that is attacking me
I’m using OSSEC server to monitor machines with OSSEC agents, which monitor this login via SSH, file creation, etc.
I have configured OSSEC to send an email when it detects a problem, but this control mode is very bad for data control and … Continue reading How to analyze/monitor OSSEC logs on Ubuntu
Today I use OSSEC as HIDS, but reading Wazuh’s site it seems to be more modern and has more resources.
I saw that it has an Elastic Stack integration, something I don’t interested about due to using Java and using a lot of server resources… Continue reading Monitor logs managed by Wazuh and OSSEC
Implying I were to use port mirroring, would it increase my network’s jitter/ping and other networking matters?
I’m using a local DNS server/forwarder, would it cause any issues?
Continue reading Do IDS/IPS/HIDS slow your network down? [migrated]
I would like to perform a few basic tests on a few of OSSEC’s capabilities and be able to document them. I have no experience with HIDS and I am not really sure where I could start or which tests with OSSEC I can perform and document.
My q… Continue reading Which tests can I perform with OSSEC?
I configured an OSSEC server on Ubuntu 20.04 to monitor changes on client machines (also Ubuntu 20.04).
My configuration aims to monitor in real time changes that occur in the default system folders and in the Apache server folder (new fil… Continue reading Use OSSEC to monitor changes to directories in real time
I am involved in a project which deals with PCI-DSS compliance. Particularly, there is a requirement to implement FIM (File Integrity Monitoring) for critical devices.
Within these devices, there are unix-based firewall and routers, with s… Continue reading File Integrity Monitoring via Syslog-ng or agentless – is it possible?
Which directory or location does the OSSEC server receive the alerts or logs from OSSEC agents and where is this path defined in the OSSEC configuration file?
I realized my system Ubuntu and windows dual boot might have been compromised. So, I installed OSSEC HIDS to try to look for issues.
When I ran dmesg, i found the following trace:
————[ cut here ]————
[ 3… Continue reading Help in understnading HIDS OSSEC traces
In snort I can easely get packet length attribute (pkt_len) related to an alert. However in Suricata I don’t see these information in JSON alerts (from eve.json). How can I get these information?
Continue reading How can I get Packet length from Suricata output?