Agents

There are two types of agents within OSSEC: installable agents and agentless agents. Installable agents are installed on hosts, and they report back to a central OSSEC server via the OSSEC encrypted message protocol. Agentless agents require no installation on remote hosts. They are processes initiated from the OSSEC manager, which gather information from remote systems, and use any RPC method (e.g. ssh, snmp rdp, wmi).

Agent

• Communication between agents and the OSSEC server
• Managing Agents
  • manage_agents on the OSSEC server
  • Extracting the key for an agent
  • Removing an agent
  • manage_agents on OSSEC agents
• Agent systems behind NAT or with dynamic IPs (DHCP)
  • DHCP Example
  • NAT Example
• Adding an agent with ossec-authd
  • ossec-authd
  • agent-auth
• Centralized agent configuration
  • Create agent configuration
  • Restart the agent

Agentless

• Agentless Monitoring
  • Agentless configuration options
  • Getting started with agentless
  • Configuring agentless
  • Running the completed setup
  • Alerts
• Writing Agentless Scripts
  • Agentless Script Types
  • Agentless Script: ssh_integrity_check_linux
  • Modifying to make own Agentless Script: ssh_dmz_linux