On Thu, Oct 3, 2013 at 9:41 AM, 22emitch <[email protected]> wrote: > I have multiple servers which are OSSEC agents and one OSSEC server and I > know that if we make a change to the rules or config on the OSSEC server > then it will change the rules and config for all the agents. I was wondering > if it was possible to create server groups so that we can apply certain > rules to specific server groups compared to all the OSSEC agents on the > system. I have not been able to find any reference to this online or on your > site. Please let me know if this is possible and if so how I would go about > creating a server group. I am running OSSEC V2.7. >
No, the best idea I can come up with is either running standalone on each system reporting to a central server, or running a server (hybrid) for each "group" you want, then having each of those servers forward alerts to a centralized server for reporting. They could even be installed on the same system (using different ports, obviously). > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
