path: root/security/ossec-hids-local-config/pkg-help-local

Unless stated otherwise, every option here corresponds to certain configuration
block which would be placed in one of the configuration files in "ossec.conf.d"
directory. Disabled options will do the same, but for "ossec.conf.d/disabled"
directory. All "*.conf" files from the "ossec.conf.d" directory will be merged
into "ossec.conf" in alphabetic order. If you are not satisfied with the
generated configuration, you can disable the corresponding option and use files
from "ossec.conf.d/disabled" directory as samples.

Files generated by the port will be overwritten during port upgrades so any
additional configuration should be put in separate files.

File Integrity Checking:

  NOAUTO_SC:
    OSSEC by default will ignore files that change too often (after the third
    change). This option disables this feature. Files that change too often
    as a result of correct system operation should better be added to ignore
    list manually.

Command Output Monitoring:

  Adds additional commands, the output of which can be monitored. To actually
  send alerts about the changing output, the proper rules need to be configured
  as well (see CMDOUT_R option).
  These commands can be tweaked in "command.conf".

Active Response Firewall:

  Creates "firewall-drop.sh" hardlink to one of the scripts shipped with OSSEC.
  This option is only meaningful if "firewall-drop" active response will be
  enabled in the configuration.