You could set the appropriate folders, assuming *nix system, such as /bin,/usr/bin,/sbin,/usr/sbin for realtime monitoring and new file alerts. Then if an installed package, regardless of YUM or dpkg/apt is installed, even by just copying it into place, you would still get an alert.
Kat On Monday, March 20, 2017 at 7:04:18 AM UTC-5, Jayalaxmi K wrote: > > Hi Team, > > could you please let me know , if application installation can be > monitored using OSSEC?? > Please let me know the rule for the same. > > Thanks in advance > Jaya > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.