Christopher J. Buckley

OSSEC is a leading Intrusion Detection System for Enterprise UNIX(-like) and Windows platforms. OSSEC is, by quite a way, the most innovative and customisable IDS product I have worked with.

As a result of it’s ease of customisations, the developer Daniel B. Cid, with a little bit of help from myself, have implemented supported rule-sets for my former employers’ products: Zeus WebServer and ZXTM. Both products are widely deployed across many enterprise environments; adding specific rulesets for their software is one which I hope assists all fellow sysadmins tasked with running infrastructure using Zeus software.

Download

You can download the latest snapshot of OSSEC from this page.

Implementation

After running install.sh you can add the Zeus rulesets as you would any other supported rule set.

Example:

<localfile>
<log_format>syslog</log_format>
<location>/usr/local/zeus/zxtm/zxtm/log/errors</location>

<localfile>
<log_format>syslog</log_format>
<location>/usr/local/zeus/zws/web/log</location>

Alerts

Below you can clearly see the ruleset alerting you, quickly and efficiently, to a failure.
 

Help..

Any questions, just ask!