<!-- Agent Example Configuration -->

<!-- First, change the server-ip to the IP of your OSSEC HIDS server. =
-->

<!-- Second, add any extra file that you may want to monitor. -->


<ossec_config>
  <client>
    <!-- IP address of the Ossec HIDS server -->
    <server-ip>192.168.65.9</server-ip>
  </client>

  <!-- One entry for each file to monitor -->
  <localfile>
    <location>Application</location>
    <log_format>eventlog</log_format>
  </localfile>

  <localfile>
    <location>Security</location>
    <log_format>eventlog</log_format>
  </localfile>

  <localfile>
    <location>System</location>
    <log_format>eventlog</log_format>
  </localfile>
</ossec_config>

<!-- Default syscheck config --><ossec_config>  <syscheck>    =
<frequency>432</frequency>    <directories =
check_all=3D"yes">C:\WINDOWS</directories>  =
</syscheck></ossec_config><!-- Updated syscheck config --><ossec_config> =
 <syscheck>    <frequency>432</frequency>    =
<ignore>C:\WINDOWS/System32/LogFiles</ignore>    =
<ignore>C:\WINDOWS/system32/wbem/Logs</ignore>    =
<ignore>C:\WINDOWS/Prefetch</ignore>    =
<ignore>C:\WINDOWS/Debug</ignore>    =
<ignore>C:\WINDOWS/PCHEALTH/HELPCTR/DataColl</ignore>    =
<ignore>C:\WINDOWS/SoftwareDistribution</ignore>    =
<ignore>C:\WINDOWS/Temp</ignore>    =
<ignore>C:\WINDOWS/SchedLgU.Txt</ignore>    =
<ignore>C:\WINDOWS/system32/config</ignore>    =
<ignore>C:\WINDOWS/system32/CatRoot</ignore>    =
<ignore>C:\WINDOWS/system32/wbem/Repository</ignore>    =
<ignore>C:\WINDOWS/LastGood.Tmp</ignore>    =
<ignore>C:\WINDOWS/LastGood</ignore>    <ignore>C:\WINDOWS/Help</ignore> =
   <ignore>C:\WINDOWS/Fonts</ignore>    =
<ignore>C:\WINDOWS/PCHEALTH</ignore>    =
<ignore>C:\WINDOWS/system32/dllcache</ignore>    <ignore =
type=3D"sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$</ignore>  =
</syscheck></ossec_config><!-- Syscheck registry config =
--><ossec_config>  <syscheck>    =
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes</windows_registry> =
   =
<windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft</windows_registry=
>    =
<windows_registry>HKEY_LOCAL_MACHINE\Software\Policies</windows_registry>=
    =
<windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control</wi=
ndows_registry>    =
<windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</w=
indows_registry>    =
<windows_registry>HKEY_LOCAL_MACHINE\Security</windows_registry>  =
</syscheck></ossec_config><!-- Syscheck registry ignored entries (too =
big or change too often) --><ossec_config>  <syscheck>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVer=
sion\Installer\UserData</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVer=
sion\Group Policy\State</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVer=
sion\WindowsUpdate</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVer=
sion\Internet Settings\Cache</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\RNG</=
registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\PchSvc</r=
egistry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Dfrg</registry_ign=
ore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM</registry_ign=
ore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc</registry_igno=
re>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\DirectDraw</regist=
ry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Direct3D</registry=
_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\COM3</registry_ign=
ore>    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows =
NT\CurrentVersion\ProfileList</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows =
NT\CurrentVersion\Prefetcher</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\Interface</registry_=
ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\TypeLib</registry_ig=
nore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\MIME</registry_ignor=
e>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\Software</registry_i=
gnore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\CLSID</registry_igno=
re>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Security\Policy\Secrets</registry_ign=
ore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\Security\SAM\Domains\Account\Users</r=
egistry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Devi=
ceClasses</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Watc=
hdog</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Medi=
aCategories</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Wind=
ows</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\hive=
list</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Serv=
iceCurrent</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Prin=
t</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Sess=
ion Manager</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eve=
ntlog</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rem=
oteAccess\Performance</registry_ignore>    =
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32=
Time\TimeProviders\NtpClient</registry_ignore>    <registry_ignore =
type=3D"sregex">\Enum$</registry_ignore>  </syscheck></ossec_config><!-- =
Extra log file --><ossec_config>  <localfile>    =
<location>C:\Windows\pfirewall.log</location>    =
<log_format>syslog</log_format>  </localfile></ossec_config>