Category: Community Contribution

Recieved a beautiful plaque from the OSSEC community (Michael Starks, I know it was your idea :)) and it says (in the OSSEC alert format):

It was the last think I was expecting and It meant a lot to me, thanks! This week of OSSEC is getting better each day 🙂

here are many types of open source projects out there. Many have the code base open (GPL, BSD, etc), but not all of them have an open culture.

On OSSEC, we try to be fully open. Not only the source code, but open to contributions, open to new developers, open to new ideas and open (friendly) to new users. So if you want to become involved and participating in this project, we have a few recommendations.

These recommendations will probably be valid for most open source projects, not only OSSEC.

How to get started:

1-The first thing you have to do is to become an active OSSEC user. I mean, install it on as many machines as you can, try different setups, see things you don’t like and start from there. Become passionate about it if you want to make a difference.

2-Start small. As any project, it takes some time to get used to how it works and how the code is organized. So start from simple things. Even if you detect a typo, try to fix that first and send us the patch.

3-Consider contributing your customizations. If you had to add a simple local rule to ignore a noisy event, send that to us! Get the log that was causing the false alert and the rule you created and send to our development mailing list or to our IRC channel (details after).

4-Get involved on our mailing lists and on IRC to see the needs and issues most users have.

5-You don’t need to be a developer or code in C. You can contribute with documentation, with the rules/decoders or even testing it. We also have our web interface (PHP), active responses/install scripts (in shell) that you can help out. So no excuses 🙂

Getting involved:

1-Our code base is available on bit bucket: http://bitbucket.org/dcid/ossec-hids/

2-Our documentation is also on bit bucket: http://bitbucket.org/jrossi/ossec-rules

3-We are always on IRC (#ossec on irc.freenode.org). That’s the best way to get quickly feedback from us and get to know everyone actively involved.

4-We also have a development mailing list, but via IRC is recommended.

If you don’t know how to access our repository on bit bucket, this link should help you: http://hginit.com

Any questions, let us know.

Taken from: http://www.ossec.net/main/week-of-ossec-2woo-oct-17-23

Week of OSSEC: Day -2
Michael Starks had the great idea to get everyone together and organize the second annual week of ossec. Last year he was the only one participating, but this year we hope to have many contributions.

To get started, Syngress decided to help out and release a few chapters of the OSSEC book for free. Plus, they are giving 30% off the book for anyone interested. Just go here and use the promotion code “43663″.

The PDF’s for the book can be downloaded here:

Chapter 2 – Installation
Chapter 3 – General configuration
Chapter 4 – Writing log analysis rules

For updates on the Week of OSSEC, I will be “tweeting” new articles: @danielcid and @ddpbsd as well.

Some blogs to follow for updates:

Michael Stark
Daniel Cid’
Dan Parriott
Xavier Mertens (he already started with a nice post).
Jason Frisvold
David Dede

And I am sure many others. If you plan on contributing, send me a note and I will add your blog/twitter link here.

Directly from: http://www.ossec.net/main/community-updates:

The OSSEC community is on fire lately! We are very happy to see everyone talking and presenting about OSSEC. Those are some of the newest updates from our community:

Wim Remes spoke about OSSEC at the Fosdem conference. The video of his presentation is on youtube:

 
Iñaki Rodríguez fromvirtualminds.es did a webmeeting about OSSEC in spanish. Slides in PDF:
http://www.virtualminds.es/uploads/charlas/ossec-slides.pdf

 
Wim Remes (yes, he again), wrote about OSSEC for the [IN]SECURE Magazine (2010 February edition):
http://www.net-security.org/insecuremag.php

 
Michael Starks from immutablesecurity.com posted a few interesting blog posts about OSSEC:

Using OSSEC for Encrypted Log Transport
Detecting Sensitive Info with OSSEC

Have you wrote something about OSSEC? Please, let us know and we will add in here.

I am happy to announce the arrival of the newest member of the OSSEC team. Priscila Cid joined our team yesterday and even though she is only 50 cm tall, she is already very active and doing very well.

Directly from the ossec site:

Michael Starks from Immutable Security finished today his series of articles about OSSEC called “Week of OSSEC“. It was meant to coincide with his speak on OSSEC at the Rochester Security Summit.

From his blog:

As a service to the community and to coincide with my speaking on OSSEC at the Rochester Security Summit, every day during the week of October 25 through October 31, I’ll be posting a new tip on OSSEC based on my years of first-hand experience. These are the tips that make the software more usable for me and hopefully, it will for you, too. Have a tip that has helped you? Be sure to post it in the comments.

– Michael Starks

Links to the articles:

• Day 1: Detecting World-Writable Files
• Day 2: Detecting New Files
• Day 3: Using Variables
• Day 4: Using Groups
• Day 5: Reusing Rule IDs
• Day 6: Developing a Tuning Strategy
• Day 7: Developing a Workflow

Be sure to check it out to learn more about OSSEC. Thanks Michael for sharing your experience with us.

Mirko Zorz from Help Net Security did an interview with me regarding OSSEC, how it was created, evolved, etc.

Link to the interview: http://www.net-security.org/article.php?id=1284.

Daniel B. Cid is the founder of the open source OSSEC HIDS and a principal researcher at Trend Micro. He has a special interest in intrusion detection, log analysis and secure development. In this interview he discusses the the open source host-based intrusion detection system in detail.

Give our readers some background on the OSSEC project. How did it all start and evolve?

OSSEC is an open source HIDS that merges log analysis, file integrity monitoring, rootkit detection and active responses. It started as a side-project to help me solve some problems that I had on a previous job (6-7 years ago)…

Thanks Mirko for the great questions and interview.