During the month of May I went to AusCERT and Confidence to talk about OSSEC (i.e. Log analysis using OSSEC). On both presentations I mentioned LIDS (Log-Based intrusion detection), and provided an overview of the ossec architecture and how to write decoders and rules. If you want to learn a bit more about ossec, take a look at them.
**Note that both presentations are very similar, but the AusCERT one is a bit more organized, so recommended to be read first.
Hope you enjoy!
Very well written and nicely presented presentation. Puts you on track on understanding the rules and its flow.
Keep up the good work Daniel.
Kasi
Hi Kasi,
Thanks for the nice words :)
Daniel