Update rootcheck system audit files about ossec-hids

[jrossi]

This is something we need to get more help on. Maybe some docs on how to manage the files and update them so we can get more people helping out.

[mstarks01]

I can probably help with this. I have contributed to the CIS benchmark so I have some experience in this area. I can't make any promises on time frame, though.

I have often pondered what the scope of rootcheck and even syscheck should be within OSSEC. It's possible to detect all kinds of malware, but then again all kinds of malware is constantly being released. At what point do you say "that's the AV scanner's job" or should we try to detect as much as we can simply due to the fact that AV detection rates are already generally poor?

[jrossi]

I think this is a vital question and something we should talk about on the mailing list. So the discussion in a more public manor. Let's move this to ossec-list

Sent from my iPhone

On Feb 16, 2014, at 10:08 AM, "mstarks01" [email protected] wrote:

I can probably help with this. I have contributed to the CIS benchmark so I have some experience in this area. I can't make any promises on time frame, though.

I have often pondered what the scope of rootcheck and even syscheck should be within OSSEC. It's possible to detect all kinds of malware, but then again all kinds of malware is constantly being released. At what point do you say "that's the AV scanner's job" or should we try to detect as much as we can simply due to the fact that AV detection rates are already generally poor?

—
Reply to this email directly or view it on GitHub.