OSSEC can solve many problems for many organizations, and it can
even be a fantastic project for a home lab.
I would suggest you start by visiting the official OSSEC website to obtain the
software and associated documentation. If you're like me, I'm always curious
about tool integration. Thankfully, Splunk can ingest and normalize OSSEC data
if you keep the native syslog format.
Active defense isn't one of the capabilities I covered in this
course, but if that's something you're interested in,
then definitely look through the provided link for details on activation
and configuration. OSSEC extensions give you additional features like
sending alerts to Slack or controlling third‑party software, so have a
look and see if something fits your needs.
Of course, there are many more resources available on the internet, but
the few I covered here should help get you going.
Thanks for taking the time to watch this course.
I hope you enjoyed it.
If you want to reach out to me,
you can follow me on Twitter @tankmek, or visit my blog at blog.edie.io.