OSSEC Notebook: July 2012

a) 2.7 - Linux rules are OK in general; but Windows rules can be tuned to reduce the number of alerts by default (Some adjustments have been done in v2.7-beta).
b) 2.x - Further gathering of feedback and adjustment of Windows rules. By default, email alerts should be meaningful and actionable (stay consistent and informative) while the rest can be viewed in a GUI (TBD).
c) 2.7 - To test whether the <do_not_group> configuration option for putting multiple alerts in one email works as expected or not (TBD).
d) 3.0 - Suggestion to tie rule alert levels with business risk factor for different assets, so non-critical assets do not trigger email notifications.
e) 3,0 - Suggestions to tie alert levels with different group characteristics. For example, admin group vs. normal groups.

a) Doc - Before ‘authd’ was available, deploying lots of OSSEC agents was very time consuming. ‘authd’ works on Linux, but some users experienced problems on Windows. Please write a success story of deploying Windows agents using ‘authd’ (TBD).
b) Doc - Write a success story of using Puppet for deploying OSSEC on Unix systems (TBD).
c) Doc - Write a success story of using OCS-ng for OSSEC mass deployment (TBD).
d) 3.0 - Making Windows Agent MSI build so users can leverage Active Directory group policy for Windows agent deployment (mstarks01)
e) 2.7 - RPM and other installation packages (TBD)
f) 3.0 - Make mass deployment easy. It should “just work” (TBD).

More frequent Rule and Decoder Updates
- a) 3.0 - Current OSSEC rules are coupled with OSSEC releases. By decoupling them it will allow faster response to current and emerging threats with faster rule fixes. Need help on architectural design (TBD)
- b) 2.7 - Decoders/Rules enhancements (DONE since 2.7-beta)
- c) 2.7 - Decoders/Rules testing (TBD)
- d) 2.7 - Releasing (jbcheng)
WUI – Web User Interface (current release 0.3, next release 0.4)

a) 0.4 - Fix OSSEC WUI 0.3 where it is incompatible with OSSEC 2.6. For example, IP address and Date field got mixed up (TBD).
b) 0.5 - Viewing alerts is currently via text display only. It would be nice to have CSV output option.
c) 0.5 - WUI reporting can be enhanced to become more useful.

a) Doc - The web site has been restructured with a new look and better navigation. Anyone can report broken links or missing information to ossecproject@gmail.com (ANY).
b) Doc - The Wiki feature on the old web site has been discontinued due to extensive spam trouble. Important content will be reproduced as static pages at user’s request (Vic, DONE in the new ossec.net).
c) Doc - Collect/create OSSEC tutorial video on YouTube (TBD)
d) Demo - Create a live demo OSSEC server, ideally with agents in virtual machines (TBD)
e) Virtual machine - Re-visit the Virtual Machine image effort which may contain OSSEC manager , WUI and even some 3rd party tools preinstalled (TBD).

a) Doc - Write a blog about Snort –> OSSEC –> Splunk (TBD)
b) Doc - Write a blog about integrating OSSEC –> ELSA (TBD)
c) 3.0 - Investigate possible synergy between Hadoop and OSSEC (TBD)
d) Make syslog output enhancement – adding File Integrity checksum to alert output so it can be used for lookups (refer to : http://www.ossec.net/doc/manual/rules-decoders/rule-lists.html and http://cr.yp.to/cdb.html) (mstarks01, DONE in 2.7-beta1)

OSSEC Notebook