Hi! Mi name is Richard.
I have a problem on the Ossec Agent. I want to scan USB devices in Windows
10 and i enable the following register on the event viewer:
Microsoft-Windows-DriverFrameworks-UserMode/Operational
Seeing the ossec documentation, in the configuration file i have to add the
following section of localfile to obtain the events:
<localfile>
*<location>*Microsoft-Windows-DriverFrameworks-UserMode/Operationa*l*
*</location>*
<log_format>eventchannel</log_format>
</localfile>
This configuration not work. If you have an idea that can help me...
Tnx!
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
