lme VS OSSEC

This may help https://github.com/ukncsc/lme/blob/master/docs/chapter2.md

But if you're still commited: there are too many variables to calculate it with any amount of certainty but you can measure it. Start off by setting up event forwarding on a small batch of test servers with only security audit logs included in the default configuration. Let it run for a few days and measure the usage and extrapolate from there. How to do most of it, you're going to find from MS documentation, but NCSC has a nice summary of it here: https://github.com/ukncsc/lme

Much appreciated. I'm a sole IT guy in a small shop so always keen to hear what others have found. I'm looking at: https://github.com/ukncsc/lme and Security Onion...

https://github.com/ukncsc/lme is this

Use something based off of a free version of Elasticsearch, like Logging Made Easy: https://github.com/ukncsc/lme or SIEMMonster or Security Onion.

Would also be repurposing sub to be a resource for Logging Made Easy, a community SIEM project by UKNCSC: https://github.com/ukncsc/lme

Does the ossec system (www.ossec.net) not use ClamWin?

OSSEC: https://www.ossec.net/ HIDS

Hi there, as per title i am trying to use this script: https://github.com/ossec/ossec-hids/blob/master/active-response/cloudflare-ban.sh

OSSEC is good for monitoring logs, system files, etc. as well as alerting (and blocking traffic if you want) when anything suspicious happens

Takes a bit of work to set up but is worth it and includes lots of basic checks by default

https://www.ossec.net/

It's been a long time since I tried using OSSEC but maybe that would help. It's a Host-based IDS, rather than a network based IDS like Snort. Last time I checked you could point it towards your logs and it will parse them offline similar to how Snort can read a PCAP file.

Not sure if it could be considered one but maybe OSSEC Host Intrusion Detection System might get you some.of the way can be found here

WAZUH (fork of OSSEC would be my first choice when it comes to Linux based HIDS (host based), and Snort or Suricata if you are looking for NIDS (network based). As well as Lynis for ensuring the setup of the host is as you intended.