bookmark_borderScreenshots of ossec wui v0.2

It looks like I did a big mistake by releasing the web ui and not providing any screenshots of it. So, here they are (better later than never).

Main page of the UI:

Search options:

Integrity checking options:

If you want to share your screenshots, just send them to us and we will publish them here too. PHP developers to help with the project are also welcome!

bookmark_borderOSSEC WUI version 0.2 is available

We are pleased to announce the release of the first non-BETA version of the OSSEC web interface (v0.2). This version contains the following features and bug fixes:

  • Added real time monitoring to the search page.
  • Added support for paginated search results.
  • Added “Log Format” as an option to allow searches based on the log format.
  • Added integrity checking page to allow monitoring of changed files/registry entries.

The full release message is available here.

Download it from here.

Install guide here.

As always, comments are welcome…

bookmark_borderFinding ADS on NTFS

ADS (Alternate Data Streams) is a “feature” of the NTFS (file system used on Windows 2000, XP, etc) that permit files to be completely hidden from the system. You can read more about ADS in these two links: ADS and lads.

Currently I am working on merging rootcheck (an anomaly detection module) to Windows and one of the things it needs to detect is hidden files using NTFS ADS. However, so far, I couldn’t find any open source tool that detects them (yes, there is freeware programs out there, but no source code). Most of the articles I read point to lads, which is free, but not open source.

So, to fill this gap, I am releasing a beta version of a small tool (ads_dump) that scans a given directory and prints every ADS found. It is a standalone tool, but it will be soon included into ossec.

You can download it from here and the source code (GPL v2) from here.

Using this tool is very simple, just execute it and pass as an argument the directory to scan. It is going to print every ADS found. Example:

ads_dump.exe dir

C:>echo hidden > C:temp/a:hidden
C:>echo hidden > C:temp/a:hidden2
C:>ads_dump.exe C:temp
Found NTFS ADS: 'C:tempa:b'
Found NTFS ADS: 'C:tempa:hidden'
Found NTFS ADS: 'C:tempa:hidden2'

*Please note that it is still in beta (comments and suggestions are welcome). It will be also be included on the next version of ossec as part of the Windows anomaly detection module.

bookmark_borderOSSEC Web UI v0.2 beta 1 available

The first beta of the ossec wui v0.2 is available for our beta testers. As I mentioned before, the best way to get involved in the project is by helping us testing our beta releases. If you do so, please let us know how it went.

You can download the beta 1 from here.

You can follow the same steps as mentioned here to install.

New features include paginated search results, real time monitoring of alerts, new integrity checking page and many other stuff (saving details for official release).

Let us know of any bugs or suggestions that you may have.

bookmark_borderOSSEC in the news

For those that missed it, ossec has gained a lot of attention lately, specially with these articles from Linux World and Network World:

You can see all other stories about ossec at our in the news wiki section.

bookmark_borderNew ossec member

I am happy to announce the arrival of a new member to the ossec team. He is only 51cm tall and weights around 3.4kg, but we expect great contributions from him as soon as he can start coding. He has no name yet, but we will find one soon (no one liked the “root” idea). The whole family is happy and doing well.

*Update (Mar 16) – Finally a name was chosen: Davi Cid