SearchOpenSource: OSSEC: The Server and Agent Model

[ Thanks to Jane Walker for this link. ]

"OSSEC is an open source host-based IDS/IPS that has two major modes of operation. In my last tip (link to previous OSSEC tip), I discussed how to install a stand-alone instance of OSSEC to run on a single machine. In this tip, I will look at OSSEC's other mode of operation--a server and agent model.

"In this mode, a central OSSEC server manages a series of remote OSSEC agents. The agents generate alerts and regular status reports, and these are forwarded to the central server and notifications generated..."

Complete Story

Related Stories:

• SearchOpenSource: Host Intrusion Detection with OSSEC(Oct 13, 2006)
• HowtoForge: Securing Your Server With A Host-based Intrusion Detection System(Sep 21, 2006)
• Linux.com: An Open Source Security Triple Play(Aug 08, 2006)