This repository has been archived by the owner on Apr 16, 2021. It is now read-only.

OSSEC: add decoders/rules for sysmon #707

Closed

dougburks opened this issue Mar 27, 2015 · 4 comments

Contributor

dougburks commented Mar 27, 2015

https://github.com/defensivedepth/Sysmon_OSSEC

Contributor Author

dougburks commented Jul 7, 2017

newer versions of OSSEC may already include sysmon decoders:
https://github.com/ossec/ossec-hids/releases

Contributor Author

dougburks commented Sep 17, 2018

Wazuh already includes sysmon decoders, so this will happen automatically as part of #708

dougburks changed the title ~~Add Josh Brower's OSSEC decoders/rules for sysmon~~ OSSEC: add decoders/rules for sysmon

Contributor Author

dougburks commented Sep 22, 2018

submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/kfn9Yb3n0xw/discussion

Contributor Author

dougburks commented Oct 1, 2018

Published:
https://blog.securityonion.net/2018/10/wazuh-361-elastic-641-and-associated.html

dougburks closed this as completed

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.