OSSEC

Contents:

• OSSEC and Elasticstack
  • Turn on json logging in OSSEC:
  • Logstash Config:
  • Filebeat Config:
• OSSEC src
  • rootcheck
  • Windows
• Required packages:
• Monitor sysmon logs
• mariadb
  • Preparing the mariadb database
  • Loading the ossec schema