[ossec-list] How to identify the User making the change - syscheck & real-time monitoring

[Dimitris Chontzopoulos]

Hello guys,

I was wondering, is there a way to also include the Account that is responsible 
for changing a file, thus, changing the hash of the
file?

Is this possible via syscheck and real-time monitoring?



Kind Regards,




Dimitris