Collaborate Disseminate
I am trying to use OSSEC with Alienvault to have some sort of file integrity monitoring. I have installed the ossec agent and I want to look for files containing credit card information. I found this link here detecting sensi… Continue reading Ossec With AlienVault Looking For Credit Card Information PCI
I have an older OSSEC deployment that has their old WUI running. However, it’s quite outdated and I’m looking to use some of the newest features of later versions (Slack integration). I’m trying to find a current GUI to manag… Continue reading What current GUI options are available for OSSEC (possibly open source)?
Security risk in extensible text editors enable hackers to abuse plugins and escalate privileges. Continue reading Researchers Show How Popular Text Editors Can Be Attacked Via Third-Party Plugins
I have read and tried this tutorial.
But it didn’t catch the OSSEC log (alerts, syslog, etc), it just give me this message for my Kibana apps.
Couldn’t find any Elasticsearch data
You’ll need to index some data into El… Continue reading How to connect OSSEC with ELK?
Within the last week, Doug Burks of Security Onion (SO) added a new script that revolutionizes the use case for his amazing open source network security monitoring platform.I have always used SO in a live production mode, meaning I deploy a SO sen… Continue reading Importing Pcap into Security Onion
Why won’t ossec block connections from another server?
I installed ossec version 2.9.3 on Ubuntu 16.04. In the ossec.conf file I have these lines where x.x.x.x is the IP address of a second Linux server:
<command>
… Continue reading Why won’t ossec block SSH connections when it seems to be configured correctly?
We have correctly deployed and operated the OSSEC FIM in Linux and Windows. When we try to monitor changes in files that have the hidden property of Windows, OSSEC does not identify the changes in them.
This is rare, becaus… Continue reading OSSEC FIM can’t monitor Windows hidden files? [on hold]
I have OSSEC installed on my own server (running Debian 7). It works just fine. What bothers me is not knowing whether or not this machine works properly. When I set the rules to OSSEC, how do I know if my rules affect my com… Continue reading What optimization value did I get before and after I used some OSSEC rules?
As far as I know, OSSEC is a Open Source HIDS. It’s a “Detection System”. I read in journals, it collect logs and flag any anomaly that had been found in a system ( e.g. Debian Server ) and do some action with it.
Some of the OSSEC’s rul… Continue reading OSSEC capabilities for handle a virus that already spread into the deepest system
I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privilege user has at that time) by looking at th… Continue reading Making sense of OSSEC logs