ossec/etc/local_decoder.xml I can't remember how I learned that (probably this list). I will be looking to add it to the documentation though.
On Thu, Aug 12, 2010 at 9:36 AM, reg <[email protected]> wrote: > Hello All, > > I have looked around, but I can't seem to find the answer online or in > the book. > > Where can I place custom decoder information so that it does not get > overwritten > when I update OSSEC? > > Thanks! > > -Reggie
