jonschipp/ossec-sandbox repository overview

Training for OSSEC. Unsafe, runs as root because OSSEC requires that.

Using ISLET:

1. Tarball in /root, untar, compile, and install
2. Start Rsyslog: service rsyslog start
3. Start OSSEC: /var/ossec/bin/ossec-control start
4. Edit ossec.conf to monitor log files in /var/log/
5. Read alerts file: tail -f /var/ossec/logs/alerts/alerts.log
6. Write rules, configure e-mail, etc.