On Wed, Apr 11, 2018, 10:18 AM <dee...@information-secure.com> wrote:

> I'm using OSSEC HIDS
>
> from this i'm getting the alerts based on all events. but, i need to know
> a *user whom modified the specific file*.
> is this possible?
>


It's still not possible out of the box. You might be able to setup some
specific auditing for specific files, but I haven't seen anyone do this.


> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to