DOCSEARCHbyAlgolia
Submit Docs

OSSEC Host-based Intrusion Detection System

repository·main·Indexed 26 days ago

https://github.com/ossec/ossec-hids

An open-source host-based intrusion detection system (HIDS) providing log monitoring and SIEM capabilities. Documentation covers installation of the Ossec-agent SELinux module, management of agents via the manage_agents CLI, and Debian/Ubuntu package builds. Also includes technical details for the integrated cJSON ultralightweight JSON parser, including build options with CMake, data structures, and parsing/printing functions.

Tokens
12.1K
Snippets
14
Records
79
Agent score
90%

What's inside OSSEC-HIDS

  1. Overview of OSSEC

    main
    OSSEC is a comprehensive platform designed to monitor and control systems. It integrates Host-based Intrusion Detection (HIDS), log monitoring, and SIM/SIEM capabilities into a single open-source solution.

  3. Capabilities of the OSSEC Windows Agent

    main

    The OSSEC Windows Agent performs the following security and monitoring tasks on the host system:

    • Real-time Event Log Monitoring: Monitors the Windows event log in real time.
    • Real-time Log Monitoring: Monitors IIS logs (Web, FTP, SMTP) and other system logs (e.g., Symantec Anti-Virus, MySQL, Apache) in real time.
    • Registry Monitoring: Periodically checks the Windows Registry for changes.
    • File Integrity Monitoring: Periodically or in real-time checks Windows folders for changes.
    • Policy Verification: Periodically performs policy verifications to ensure the system is configured according to defined security policies.

  6. Download OSSEC-HIDS Debian/Ubuntu packages

    main

    Pre-built OSSEC-HIDS packages for Debian and Ubuntu can be downloaded from the official OSSEC website or directly from the Wazuh APT repository.

    Available packages:

    • ossec-hids: Includes both the server and the agent.
    • ossec-hids-agent: Includes only the agent.
    http://www.ossec.net/?page_id=19
http://ossec.wazuh.com/repos/apt/

  7. Install and build cJSON

    main

    cJSON can be integrated into projects using several methods:

    Copying Source

    Since the library consists of only cJSON.h and cJSON.c, you can copy these files directly into your project source.

    Using CMake

    CMake (version 2.8.5 or higher) is the recommended build system. For Unix platforms, it is recommended to perform an out-of-tree build:

    mkdir build
cd build
cmake ..
make

    Using Makefile

    Note: This method is deprecated. If CMake is unavailable, you can use the provided Makefile:

    make all

    Using Meson

    Include libcjson as a dependency in your meson.build file:

    project('c-json-example', 'c')
cjson = dependency('libcjson')
example = executable('example', 'example.c', dependencies: [cjson])

    Using Vcpkg

    git clone https://github.com/Microsoft/vcpkg.git
cd vcpkg
./bootstrap-vcpkg.sh
./vcpkg integrate install
vcpkg install cjson
    mkdir build
cd build
cmake ..
make

  8. Build ZLib.Ada using Aonix ObjectAda for Win32 7.2.2

    main

    Follow these steps to build ZLib.Ada in an Aonix ObjectAda environment:

    1. Create a project containing all *.ads and *.adb files from the distribution.
    2. Build the libz.a library from the original ZLib C sources.
    3. Rename libz.a to z.lib.
    4. Add z.lib to your Ada project.
    5. Add the libc.lib library from the ObjectAda distribution to the project.
    6. Build the executable using test.adb as the main procedure.

  10. Install the Ossec-agent SELinux module

    main

    To provide additional security protection for the OSSEC application using SELinux, follow these steps on a running SELinux installation:

    1. Install the SELinux policy module: semodule -i ossec_agent.pp.bz2
    2. Restore the security contexts for the OSSEC directory: restorecon -R /var/ossec
    3. Restart the OSSEC agent using your system's service manager (e.g., systemd, init).
    4. Verify that the agent has the correct security context by running ps -AZ.

  11. Use the zlibpas Pascal interface

    main

    The zlibpas.pas unit provides a Pascal (Delphi, Kylix) interface to the zlib data compression library.

    Key Compatibility and Usage Notes:

    • Naming Conflict: Do not confuse this unit with Borland's built-in ZLib unit. Borland's unit is a suite of class wrappers that lacks essential features like checksums. Use zlibpas for full-fledged zlib functionality.
    • Calling Convention: The interface uses the cdecl keyword. This means it is not compatible with old Turbo Pascal. It is designed for environments using __pascal (DOS/Windows16) or __fastcall (Windows32).
    • Type Mapping: C types are translated to Pascal types of similar sizes to avoid namespace pollution (e.g., int to Integer, long to LongInt). Note that unsigned integers are not explicitly converted to Pascal unsigned integers.
    • Limitations: The gz* function interfaces are not translated to avoid C runtime library interfacing problems. Specifically, gzprintf cannot be used via this Pascal interface.