wazuh-docker VS OSSEC

Now based on my reading of https://github.com/wazuh/wazuh-docker/issues/775This is means i should enter the indexer container and run securityadmin after setting the environment variables specified in the docs....I did this. The command completes successfully with no errors.

Greetings, for an implementation with ansible we do not have official documentation, however we can recommend an implementation with docker, here the guide https://github.com/wazuh/wazuh-docker

I mean, you could set it up as a container too - although I'm sure someone has already done this for you - for example, Wazuh themselves at https://github.com/wazuh/wazuh-docker

I think you can install a Wazuh + ELK stack docker https://github.com/wazuh/wazuh-docker. Changing the ports by docker proxy. It will be safe

Does the ossec system (www.ossec.net) not use ClamWin?

OSSEC: https://www.ossec.net/ HIDS

Hi there, as per title i am trying to use this script: https://github.com/ossec/ossec-hids/blob/master/active-response/cloudflare-ban.sh

OSSEC is good for monitoring logs, system files, etc. as well as alerting (and blocking traffic if you want) when anything suspicious happens

Takes a bit of work to set up but is worth it and includes lots of basic checks by default

https://www.ossec.net/

It's been a long time since I tried using OSSEC but maybe that would help. It's a Host-based IDS, rather than a network based IDS like Snort. Last time I checked you could point it towards your logs and it will parse them offline similar to how Snort can read a PCAP file.

Not sure if it could be considered one but maybe OSSEC Host Intrusion Detection System might get you some.of the way can be found here

WAZUH (fork of OSSEC would be my first choice when it comes to Linux based HIDS (host based), and Snort or Suricata if you are looking for NIDS (network based). As well as Lynis for ensuring the setup of the host is as you intended.