On 06/10/2010 10:23 AM, Richard Geddes wrote:
Can ossec detect changes in the devices that are connected to the host? Maybe through the file integrity checker?For example, if someone plugs a usb memory stick into a machine.
Yes. OSSEC can alert on the logs that get written when these events happen. This is something relevant to your question: http://www.ossec.net/dcid/?p=199
-- Michael Starks [I] Immutable Security http://www.immutablesecurity.com
