to be added later<\/em><\/p>\n\n\n\n6- Integrity checking<\/h1>\n\n\n\n
Integrity checking is one of the most misused options on OSSEC. It can range from very annoying to completely useless if you don\u2019t do it properly. The default options from OSSEC don\u2019t help much with that as well.<\/p>\n\n\n\n
The real goal of integrity checking is to verify that the integrity of the files are still intact (they haven\u2019t changed). However, if a file changes many times per week, it becomes very hard to distinguish between a normal and a malicious change.<\/p>\n\n\n\n
How we use integrity checking:<\/p>\n\n\n\n
1- On real time 2- Only on a few set of files 3- Storing the changes so I can compare if needed<\/p>\n\n\n\n
The real time option is specially important, because I can tie it with my policy rules to alert when they happen on times it shouldn\u2019t.<\/p>\n\n\n\n
So, on my web servers, we add the following in there:<\/p>\n\n\n\n
<directories realtime=\"yes\" report_changes=\"yes\" restrict=\".php|.js\">\/var\/www<\/directories>\n<\/pre>\n\n\n\nWhich restricts the integrity checking to the files we care (generally .php, .js, .htm, etc) and monitors those in real time. So when a file changes I get the alert showing what was modified as well.<\/p>\n\n\n\n
7- Conclusion<\/h1>\n\n\n\n
This is not a finished document, we will keep updating it as time permits. But if you have questions or concerns, please don’t hesitate to ask. <\/p>\n","protected":false},"excerpt":{"rendered":"
People often ask us how we like to setup OSSEC or how we use it internally on my own servers. We always do a set of customizations to make sure we use it the best way possible. In this article we will show step by step those steps and hopefully it can be helpful to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/pages\/396"}],"collection":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/comments?post=396"}],"version-history":[{"count":2,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/pages\/396\/revisions"}],"predecessor-version":[{"id":400,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/pages\/396\/revisions\/400"}],"wp:attachment":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/media?parent=396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}