OSSEC HIDS HOST-BASED INTRUSION DETECTION GUIDE
CHAPTER 1 GETTING STARTED WITH OSSEC INTRODUCTION INTRODUCING INTRUSION DETECTION NETWORK INTRUSION DETECTION HOST-BASED INTRUSION DETECTION FILE INTEGRITY CHECKING REGISTRY MONITORING ROOTKIT DETECTION ACTIVE RESPONSE INTRODUCING OSSEC PLANNING YOUR DEPLOYMENT LOCAL INSTALLATION AGENT INSTALLATION SERVER INSTALLATION WHICH TYPE IS RIGHT FOR ME? IDENTIFYING OSSEC PRE-INSTALLATION CONSIDERATIONS SUPPORTED OPERATING SYSTEMS SPECIAL CONSIDERATIONS MICROSOFT WINDOWS SUN SOLARIS UBUNTU LINUX MAC OS X SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 INSTALLATION DOWNLOADING OSSEC HIDS GETTING THE FILES PREPARING THE SYSTEM CONTENTS BUILDING AND INSTALLING PERFORMING LOCAL INSTALLATION PERFORMING SERVER-AGENT INSTALLATIONS INSTALLING THE SERVER MANAGING AGENTS INSTALLING AGENTS INSTALLING THE UNIX AGENT INSTALLING THE WINDOWS AGENT STREAMLINING THE INSTALLATIONS INSTALL ONCE, COPY EVERYWHERE UNIX, LINUX, AND BSD PUSH THE KEYS CHAPTER 3 OSSEC HIDS CON? GURATION UNDERSTANDING THE OSSEC HIDS CON? GURATION FILE CON? GURING LOGGING/ALERTING OPTIONS ALERTING WITH EMAIL CON? GURING EMAIL BASIC EMAIL CON? GURATION GRANULAR EMAIL CON? GURATION RECEIVING REMOTE EVENTS WITH SYSLOG CON? GURING DATABASE OUTPUT DECLARING RULE FILES READING LOG FILES CON? GURING INTEGRITY CHECKING CON? GURING AN AGENT CON? GURING ADVANCED OPTIONS CHAPTER 4 WORKING WITH RULES INTRODUCING RULES UNDERSTANDING THE OSSEC HIDS ANALYSIS PROCESS PREDECODING EVENTS DECODING EVENTS DECODER EXAMPLE: SSHD MESSAGE DECODER EXAMPLE: VSFTPD MESSAGE USING THE <PARENT> OPTION DECODER EXAMPLE: CISCO PIX MESSAGE DECODER EXAMPLE: CISCO IOS ACL MESSAGE UNDERSTANDING RULES ATOMIC RULES WRITING A RULE COMPOSITE RULES WORKING WITH REAL WORLD EXAMPLES INCREASING THE SEVERITY LEVEL OF A RULE TUNING RULE FREQUENCY IGNORING RULES IGNORING IP ADDRESSES CORRELATING MULTIPLE SNORT ALERTS IGNORING IDENTITY CHANGE EVENTS WRITING DECODERS/RULES FOR CUSTOM APPLICATIONS DECIDING WHAT INFORMATION TO EXTRACT CREATING THE DECODERS CREATING THE RULES MONITORING THE LOG FILE CHAPTER 5 SYSTEM INTEGRITY CHECK AND ROOTKIT DETECTION UNDERSTANDING SYSTEM INTEGRITY CHECK (SYSCHECK) TUNING SYSCHECK WORKING WITH SYSCHECK RULES IGNORING SPECI? C DIRECTORIES INCREASING THE ALERT SEVERITY FOR IMPORTANT FILES INCREASING THE SEVERITY FOR CHANGES DURING THE WEEKEND CON? GURING CUSTOM SYSCHECK MONITORING DETECTING ROOTKITS AND ENFORCING/MONITORING POLICIES DETECTING ROOTKITS ON LINUX, UNIX, AND BSD DETECTING ROOTKITS WITH SIGNATURES MONITORING AND ENFORCING POLICY POLICY MONITORING RULES THE ROOTCHECK QUEUE CHAPTER 6 ACTIVE RESPONSE INTRODUCING ACTIVE RESPONSE EXAMINING ACTIVE RESPONSE COMMAND TYING IT TOGETHER CREATING A SIMPLE RESPONSE THE EXECUTABLE THE COMMAND THE RESPONSE CON? GURING A RESPONSE WITH TIMEOUT HOST-DENY COMMAND HOST-DENY RESPONSE CHAPTER 7 USING THE OSSEC WEB USER INTERFACE INTRODUCING THE OSSEC HIDS WUI IDENTIFYING WUI PRE-INSTALLATION CONSIDERATIONS DOWNLOADING THE WUI INSTALLING AND CON? GURING THE WUI ADVANCED INSTALLATION TOPICS USING HTACCESS FOR MULTI-USER ACCESS ENABLING SSL ACCESS OPTIMIZING PHP FOR LARGE OSSEC DEPLOYMENTS DESCRIBING THE WUI COMPONENTS MAIN AVAILABLE AGENTS LATEST MODI? ED FILES LATEST EVENTS SEARCH ALERT SEARCH OPTIONS RESULTS ALERT LIST INTEGRITY CHECKING LATEST MODI? ED FILES (FOR ALL AGENTS) DUMP DATABASE STATS STATS OPTIONS OSSEC STATS OSSEC STATS SNAPSHOT AGGREGATE VALUES BY SEVERITY AGGREGATE VALUES BY RULE TOTAL VALUES PER HOUR ABOUT EPILOGUE