Hey folks, I've just found OSSEC and I'm interested in seeing how well it works to monitor our network for any activity on our clients. I've got the basic server running and a client, and I've kind of got the web interface running so I can see that my one client is connected.
My first question is whether OSSEC is really designed as something to monitor clients on a network? It sounds like it might be aimed more at servers? Secondly, if this is the right program, is there any way to automate the installation of the agent on a large number of Windows machines? I can see that it's possible to script the addition of agents on the server side, but from what I've read it appears that I would still need to extract the keys for every single machine, and manually paste them in during the installation. Is there no way to roll this out using a script so the agents can automatically connect to the server? Even a way to pass the install program the key and server IP would do, that would at least let me run a startup batch file on the network to automate the installation. thanks, Ross
