Hi Ross, OSSEC is generally more used at servers, but it can certainly be used to monitor desktop systems. I know quite a few people that do that with a lot of success.
As far as the installation, it can be scripted very easily. The authentication key is just a text file (client.keys), so you can send that with the ossec package. The following article explains how to do on linux, but you get the idea on how to do on Windows too: http://searchsecuritychannel.techtarget.com/generic/0,295582,sid97_gci1323745,00.html thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Tue, Jan 20, 2009 at 7:32 AM, Ross Smith <[email protected]> wrote: > > Hey folks, > > I've just found OSSEC and I'm interested in seeing how well it works > to monitor our network for any activity on our clients. I've got the > basic server running and a client, and I've kind of got the web > interface running so I can see that my one client is connected. > > My first question is whether OSSEC is really designed as something to > monitor clients on a network? It sounds like it might be aimed more > at servers? > > Secondly, if this is the right program, is there any way to automate > the installation of the agent on a large number of Windows machines? > I can see that it's possible to script the addition of agents on the > server side, but from what I've read it appears that I would still > need to extract the keys for every single machine, and manually paste > them in during the installation. > > Is there no way to roll this out using a script so the agents can > automatically connect to the server? Even a way to pass the install > program the key and server IP would do, that would at least let me run > a startup batch file on the network to automate the installation. > > thanks, > > Ross >
