Legacy Documentation

Warning

This documentation is no longer maintained, and will be removed as the non-legacy documentation is updated.

Manual & FAQ

• Manual
  • Getting started with OSSEC
  • OSSEC Architecture
  • Supported Systems
  • Installation
  • Agents
  • Log monitoring/analysis
  • Syscheck
  • Rootcheck Manual
  • Rules and Decoders
  • Output and Alert options
  • Active Response
• Frequently asked questions
  • Agents: FAQ
  • Alerts: FAQ
  • Installation: FAQ
  • Miscellaneous: FAQ
  • OSSEC: FAQ
  • OSSEC-WUI: FAQ
  • Syscheck: FAQ
  • When the unexpected happens: FAQ

Development

• Build, compile, and not much more
  • install.sh
  • Makefile
  • test-rules:
• oRFC:
  • oRFC: 1 The Collective Code Construction Contract (C4)
  • oRFC: 2 Coding Style Guide

Reference

• Syntax and Options
  • Regular Expression Syntax
  • Log Analysis Syntax: Rules and Decoders
  • ossec.conf: syntax and options
  • agent.conf
  • internal_options.conf: syntax and options
• Output Formats
  • OSSEC alert log samples
  • JSON Format
  • cef log format:
• Man pages
  • agent-auth
  • agent_control
  • clear_stats
  • list_agents
  • manage_agents
  • ossec-agentd
  • ossec-agentlessd
  • ossec-analysisd
  • ossec-authd
  • ossec-control
  • ossec-csyslogd
  • ossec-dbd
  • ossec-execd
  • ossec-logcollector
  • ossec-logtest
  • ossec-maild
  • ossec-makelists
  • ossec-monitord
  • ossec-regex
  • ossec-remoted
  • ossec-reportd
  • ossec-syscheckd
  • rootcheck_control
  • syscheck_control
  • syscheck_update
  • util.sh
  • verify-agent-conf
• Examples
  • Contents: