OSSEC Host-Based Intrusion Detection Guide

* Nominee for Best Book Bejtlich read in 2008!* taosecurity.blogspot.com/2008/12/best-book-bejtlich-read-in-2008.html. Get Started with OSSECGet an overview of the features of OSSEC including commonly used terminology, pre-install preparation, and deployment considerations. . Follow Steb-by-Step Installation InstructionsWalk through the installation process for the "local¿, "agent¿, and "server" install types on some of the most popular operating systems available.. Master ConfigurationLearn the basic configuration options for your install type and learn how to monitor log files, receive remote messages, configure email notification, and configure alert levels.. Work With RulesExtract key information from logs using decoders and how you can leverage rules to alert you of strange occurrences on your network.. Understand System Integrity Check and Rootkit DetectionMonitor binary executable files, system configuration files, and the Microsoft Windows registry.. Configure Active ResponseConfigure the active response actions you want and bind the actions to specific rules and sequence of events.. Use the OSSEC Web User InterfaceInstall, configure, and use the community-developed, open source web interface available for OSSEC.. Play in the OSSEC VMware Environment Sandbox. Dig Deep into Data Log MiningTake the "high art¿ of log analysis to the next level by breaking the dependence on the lists of strings or patterns to look for in the logs.

Chapter 1: Introduction This chapter will introduce you to the OSSEC project, its history, and its goals.Chapter 2: Getting Started With OSSEC This chapter provides an overview of the features of OSSEC including commonly used terminology, pre-install preparation, and deployment considerations.Chapter 3: Installation This chapter walks through the installation process for the "local" and "server" install types, including the Windows and Unix agent, and techniques to automate multiple agents installations.Chapter 4: Configuration This chapter discusses the post-install configuration of OSSEC. Within this chapter you learn how to monitor log files, remote messages, email notification, alerting levels, etc. Chapter 5: Working With Log Analysis - Decoders This chapter shows you how to extract key information from logs using decoders.Chapter 6: Working With Log Analysis - Rule Files This chapter discusses how you can leverage rules for various devices and how to write your own rules. It will include examples on how to parse atomic and composite rules, how to keep state between messages, remove false positives and tune it appropriately.Chapter 7: Configuring System Integrity Check This chapter explains the system integrity check features of OSSEC including monitoring of the binary executable files, system configuration files, and even the Windows registry.Chapter 8: Rootkit Detection This chapter explains the rootkit detection capabilities of OSSEC on Unix and its configuration. Chapter 9: Policy Enforcement This chapter explains the policy enforcement capabilities of OSSEC, explaining how to perform host-based system auditing and application monitoring. Chapter 10: Active Response Configuration This chapter explains how to configure the active response actions you want to configure as well as how to bind the actions to specific rules or events.Chapter 11: Integration and Advanced Configuration This chapter explains previously undocumented features, advanced configuration topics, and integration with third-party products. Chapter 12: Using the Web interface This chapter explains how to install and use the community developed, open source web interface, that is available for OSSEC. Appendix A: The Importance of Log Analysis