[ossec-list] Re: Custom Rules for deeper registry monitoring

2015-05-15 Thread Justin Hazard
all the changes > to the OSSEC system for future review > > You might also check out Josh Bower's Sysmon 2.0 integration with OSSEC. > This can help you monitor executable processes on your windows system > good stuff! > > > > On Friday, May 15, 2015

[ossec-list] Custom Rules for deeper registry monitoring

2015-05-15 Thread Justin Hazard
Hey Everyone, Huge fan of OSSEC, just got my first implementation up and operational. I have a few rules that I want to right, just for testing sake. What we are looking to do, is to write two separate rules that achieve similar results, and more specifically we want to know when any change is