OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. (from www.ossec.net)

learn more… | top users | synonyms

1
vote
0answers
21 views

keep ossec iptables rules after restarting OSSEC

I have 6 OSSEC installations (5 agents + 1 server, all Debian 8) all configured to block repeated offenders using iptables from 10 minutes to 1 month. I have the need to restart one or more of the ...
0
votes
2answers
90 views

Has anyone used any custom decoders with OSSEC?

I have the OSSEC HIDS software version 2.8.3 running on a RHEL 6 server. We have been testing this in the lab with a DNS server to track queries that come into our RPZ and Malware zones. The DNS ...
0
votes
1answer
169 views

Postfix Send only Without a FQDN

I'm using OSSEC and Nagios to build a sort of HID system on our network. Everything is going smoothly so far; however I cannot get OSSEC to send email alerts. What I'm trying to do right now is get ...
1
vote
0answers
77 views

How/where does one get a version of the OSSEC agent-auth application that will run on Windows?

I have successfully configured an OSSEC server running on Ubuntu in AWS. I have also successfully automated Ubuntu AWS instances automatically installing the OSSEC agent and connecting to the OSSEC ...
0
votes
1answer
138 views

OSSEC alerts without hosting SMTP

I've been searching without a solid solution yet. I need to send OSSEC email alerts from my OSSEC server, but without hosting an SMTP server (postfix, etc). I get rejected by the Google SMTP servers ...
0
votes
0answers
140 views

OSSEC Agent won’t connect to the manager or the agent always shows never connected

From the ossec agents ossec.log I am getting the: 2015/09/15 15:32:04 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'ossec.domain.com/10.x.x.x'. 2015/09/15 15:33:00 ...
0
votes
1answer
50 views

Install ossec ids on citrix xenserver dom0

I'm running citrix xen server on a server with two nic each with dedicated public ip and the management interface is directly connected to the www and protected with iptables that allow connections ...
0
votes
1answer
99 views

How to create custom notification for ossec

I am installing OSSEC for secure our servers, and I want to use slack instead of email for notification. Is there a way to send alerts via slack? Is there any way to add another notification system ...
0
votes
0answers
213 views

Ossec Agent won't communicate with Server

I can't seem to connect. It used to work: On the server: [root@admin1 bin]# ./agent_control -l OSSEC HIDS agent_control. List of available agents: ID: 007, Name: dns, IP: 10.0.0.3, Disconnected ...
0
votes
0answers
154 views

OSSEC Web UI 404 on initial setup

I'm trying to setup the OSSEC web UI on a fresh installation of OSSEC on Ubuntu 15.04 Server Edition. I setup the server with the default LAMP stack and OSSEC HIDS seems to have installed ...
1
vote
0answers
29 views

I can installa “Ossec” on xenserver host? [closed]

I own a xenserver where the host is connected to the public ip network. I allow connections only from my static ip and deny amy other with iptables, but I can install monitoring system like Ossec ...
1
vote
0answers
146 views

OSSEC error, file 'not found or unable to stat'

I can't seem to squash this error. I recently installed OSSEC on a Digital Ocean droplet, and I'm getting this message every 15 minutes or so. I've tried blocking the client IP addresses with UFW, ...
0
votes
2answers
260 views

How do I get OSSEC manage_agents to read a file?

According to the help docs of manage_clients: -f Bulk generate client keys from file. (Manager only). contains lines in IP,NAME format. So I tried this: ...
1
vote
2answers
474 views

OSSEC disk space usage

A few days ago I noticed that the disk of my Ubuntu server was almost full. I dug a bit and found out that the disk space was used by OSSEC, in the /var/ossec/queue/diff folder. I wanted to try ...
0
votes
1answer
82 views

Change OSSEC alert emails “From” header

I'd like to know how to change the name in the "From" header for emails sent by OSSEC. I couldn't find any information about that. Alerts I receive from my server are quite well organized. And OSSEC ...
1
vote
1answer
563 views

OSSEC won't start, Error: queue not accessible

I'm trying to set up OSSEC on a CemtOS 6.5 server. This is to be installed as an agent, not a server or local instance. The package successfully installed and I created the clients.key file, but when ...
0
votes
1answer
138 views

OSSEC - Multiple VM's on a single DELL blade (XenServer Hypervisor)

I have a DELL blade with ~100 VM's (with a Citrix XenServer 6.1 hypervisor), all with ossec agent connected to a ossec server outside that same blade. I have a bit of a problem: they all run rootkit ...
0
votes
1answer
129 views

Is there a better way of handling ossec-logcollector?

I have been working to integrate application logs with the ossec logcollector. I have successfully created, decoded, command, rules etc, and everything works and fires triggers. However our ...
0
votes
1answer
591 views

Deploying Ossec HIDS Windows Agent via GPO

I am trying to deploy OSSEC agent to about 100 Windows 7 boxes through GPO on our AD. I understand that I need to create and MSI from the EXE and import the specific client.keys file for the windows ...
0
votes
1answer
38 views

How to filter errors 404 to show only those which are related to php files?

One of my web servers is getting flooded with requests to resources that do not exist anymore, generating the corresponding 404 error. As I'm using OSSEC and OSSIM, then these errors are sent to the ...
1
vote
1answer
363 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
1
vote
1answer
123 views

OSSec not working on server with multiple IPS

I had to add another IP address to our server (eth0:1 192.168.0.100) and all of the sudden ossec client stopped working. On the client side I'm seeing this: 2014/02/19 02:31:28 ossec-agentd: INFO: ...
0
votes
0answers
207 views

ossec 2.7.1 won't update on servers

I'm trying to update ossec machines setup as servers from 2.6 and 2.7 to 2.7.1. I download the ossec-hids-2.7.1.tar.gz, extract it, and run the ./install.sh. It recognizes there's a previous ...
1
vote
1answer
1k views

Suppress OSSEC email for failed root ssh

I'm running OSSEC as a HIDS on a Ubuntu 12.10 server, and it routinely (3-4x a day) sends me a notification like this: (note the last octet of the IP address has been changed to 'xxx' to protect the ...
0
votes
2answers
341 views

OSSEC as a SIEM

I am working on a log aggregation project and wanted to add some minor correlations/security intelligence to the mix. Currently I have logs from ~400 servers coming into a syslog-ng box. I was looking ...
1
vote
3answers
772 views

Simple application level file integrity monitoring & Intrusion detection (IDS)

We've been searching for a simple file integrity monitoring solution on CentOS/Linux that will work on the application level. We are not looking for OS/network level IDS as OSSEC and the others do a ...
0
votes
1answer
989 views

OSSEC “unable to retrieve alerts”

I try to learn about Ossec, but, when i access to the Ossec web UI in the Main tab, Ossec shows me: "unable to retrieve alerts" I see the alerts.log file and i can read different problems. Why i ...
0
votes
1answer
879 views

how does OSSEC agent detects signature/alerts?

Can someone explain how does ossec agent in an active response config detects or responds to events (e.g scan attempt on web-server 404 status code). I know that the below xml block at the server ...
0
votes
1answer
1k views

Ossec tests and verification

I have just installed OSSec accordingly as the server. When it asked for my email I put in my GMail address and for the SMTP I was not sure so I just set it as localhost first. Then it runs a number ...
1
vote
1answer
2k views

Generating alerts from ossec ( server- agent ) model

I'm very new to OSSEC. I use a server-agent model. I wish to generate alert for the following actions ( in agent side ): 1) Sample Alert for delation of logs I added the rules for these in agent's ...
1
vote
1answer
1k views

OSSEC is not running

I have an two ec2 instances. In one I have installed ossec server and in other I have installed ossec agent. Here are my server config INBOUND (security group/firewall) : port:514 ...
0
votes
1answer
149 views

Email sending script from address is invalid

i am sending email notifications from OSSEC active response script firewall-drop.sh, but when the email is sent through it, the FROM address is like this -@mydomain.com it should be ...
2
votes
1answer
367 views

What is the purpose of filtering egressing traffic (CSF)?

For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF). I tested it for small DoS attacks such a slowloris variants ...
2
votes
1answer
681 views

OSSEC agent behind NAT

I am working on an OSSEC deployment where I will have multiple agents behind 1 public IP. Below is an example of the setup Private Network OSSEC-Agent1 (192.168.1.10) OSSEC-Agent2 ...
10
votes
2answers
4k views

OSSEC large scale deployment

We have a data-center and as a happy OSSEC user I am trying to convince my management to use it for host intrusion detection. However I have never deployed it on more than a handful of servers and I ...
2
votes
1answer
198 views

Ossec fields to Oracle DB

I would like some recommendations for the following problem. I use Ossec for log analysis. What I want, is after extracting the fields to save them in an Oracle database. For example, if I have this ...
0
votes
1answer
679 views

ossec email alerts

Just installed ossec and sendmail however can't able to get alerts to my gmail from ossec. I am able to see the alerts on the sendmail localhost, however alerts seem to be not forwarding to gmail.
2
votes
1answer
2k views

OSSEC: Unblock an IP and increase tresshold

I just set up OSSEC, but I accidentally shut myself out already from my home ip. So does OSSEC have a function to unblock an IP after it is blocked or do I need to do this manually in iptables ? ...
1
vote
2answers
344 views

What dangers (and should I be worried) are there from attempted break-ins? (reported by OSSEC)

I've installed OSSEC on my server and I've been getting reports similar to the following: Jan 11 19:27:03 Daddy sshd[14459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 ...
1
vote
0answers
598 views

Where can I find information about inbuilt registry keys for Windows Server 2008 R2?

Is there a resource for looking up the description and/or usage of W2K8 R2 registry keys? I need to understand integrity checksum change messages appearing in OSSEC logs on Amazon EC2 instances. ...
1
vote
2answers
2k views

Do I need at least 1 Linux server to use OSSEC to monitor my Windows servers?

I don't know why this isn't more plainly obvious on the website: http://www.ossec.net/ But I can't tell if I need to install a 'server' portion on Linux and then an 'agent' on Windows and then ...
0
votes
1answer
1k views

OSSEC HIDS Notification emails every five minutes from server

My server is sending me the below error message to my email every five minutes: OSSEC HIDS Notification. 2011 Jun 17 16:30:03 Received From: ubuntu->/var/log/syslog Rule: 1002 fired ...
2
votes
1answer
879 views

Just installed OSSEC, what next?

We need file integrity monitoring on our windows servers (a webserver and a database server) and before we drop money on Tripwire, I'm checking out OSSEC. I installed a local installation to test with ...
2
votes
1answer
706 views

Use OSSEC active response behind load balancer

We have OSSEC installed on some web servers running behind Amazon ELB. The problem is that when the active response triggers it blocks the IP address of the load balancer. Is there any way to use the ...
3
votes
1answer
121 views

PID ran away with all our MEM and SWAPPED hard - OSSEC RHEL

Forgive me for the length of this question... it is mostly details... only attempt to follow if you also enjoy reading log files... or drinking coffee. I'll state the questions first: 1) how the ...
6
votes
1answer
3k views

OSSEC integrity checksum alert - what caused the change?

Recently installed OSSEC on Linux machine to test. Most results are expected, however yesterday I received emails with a number of notifications about Integrity checksum changing on files such as ...
0
votes
2answers
447 views

HOw to know if files md5 chnaged by virus or system itself centos

I installed OSSSEC to very files have chnaged or not. But sometimes it is giving me false waring and integrity checksums like following files have chnaged. How can i makesure that files are chnaged ...
1
vote
1answer
112 views

HOw to view all Logs in OSSSEC system ubuntu

I have installed OSSEC It is working and sometime sending me alert email as well. But i want to see what can i type so that i can get view all the logs of what OSSEC has found in my system
0
votes
1answer
905 views

CAn not open port 1514 in ubuntu iptables

I am installing OSSEC and it says that i need to open port 1514 and 514 in firewall. Now i have added the rule for port 1514 but i still can't get coonect if i use telney like ossec-hids-2.5]# ...