Newbie to both....
I've installed OSSEC and it is up/running fine and collecting data from the agents. Starting to play with OSSIM and it installs OSSEC by default. Is there a way to have my original OSSEC server forward the events to OSSIM or do they both need to be on the same server? I think I'd rather have them both on separate servers from a performance/ upgrade/blah standpoint
