Hello You can install one OSSEC agent by VM (inside the host). The events are then forwarded to the OSSEC Server (Physical of Virtual).
For more details, can you provide more info on your architecture ? (Especially what you consider as 'cloud'). Kind regards Js
