OSSEC Manual

• Installation
  • Installation Types
    • Server
    • Agent
    • Hybrid
    • Local
  • Installations requirements
    • PCRE2
    • zlib
    • Ubuntu
    • RedHat/CentOS
    • OpenSuse
    • Debian
    • Alpine Linux
    • OpenBSD
    • FreeBSD
  • Build Options
    • Required
      • TARGET
    • Optional
      • ZLIB_SYSTEM
      • PCRE2_SYSTEM
      • LUA_ENABLE
      • MAXAGENTS
      • USE_PRELUDE
      • USE_ZEROMQ
      • USE_GEOIP
      • USE_INOTIFY
      • USE_PCRE2_JIT
      • REUSE_ID
      • Settings
  • Install from source
    • Manager/Agent Installation
    • Manual Installation
  • Package Installation
    • RPM Installation
    • Deb Installation
    • FreeBSD Ports
  • Windows Agent Installation
    • OSSEC Windows executable
    • Chocolatey
  • Compiling OSSEC for a Binary Installation
    • Compiling OSSEC for install on a second server
    • Installation of the binary OSSEC package
  • Compiling OSSEC 3.x with MinGW
    • Requirements
    • Compilation
• Agent Management
  • manage_agents
  • Adding an agent
  • ossec-authd
  • Adding an agent example
  • Adding an agent with authd example
• Agentless Management
  • agentlessd
  • Adding Hosts
• Log Monitoring
  • What is log monitoring
  • log files
  • commands
  • syslog
• Decoders and Rules
  • Decoders
    • decoder
    • parent
    • accumulate
    • program_name
    • program_name_pcre2
    • prematch
    • prematch_pcre2
    • regex
    • pcre2
    • order
    • fts
    • type
  • Rules
    • rule
    • match
    • regex
    • pcre2
    • decoded_as
    • category
    • srcip
    • dstip
    • extra_data
    • user
    • program_name
    • hostname
    • time
    • weekday
    • id
    • url
    • if_sid
    • if_group
    • if_level
    • if_matched_sid
    • if_matched_group
    • same_id
    • same_source_ip
    • same_source_port
    • same_dst_port
    • same_location
    • same_user
    • description
    • list
    • info
    • options
    • check_diff
    • group
• Regular Expression Syntax
  • pcre2
  • OS_Regex/regex
  • OS_Match/sregex