Hi
Anyone have an idea to solve a small problem I have set myself? I have lots of client PC's out there each with a local install server/client - and each can operate independently of any central server. These are scattered around the Country. I also have a centralised OSSEC server connected to many workstations via a client/server vpn - but not to all sites It would be great if I can retain all PC's running independently, but forward significant events - say level 5 or over - when/if connected to my central OSSEC server as well for reporting purposes. Any ideas? Andi
