4 ms·

This is built upon OSSec[1]. While it works ok, with Elastic underneath it's far too much maintenance for my 30 servers. [1] - https://www.ossec.net/ https://w

• ArnoVW 2y ago
  There is a hosted offering https://wazuh.com/cloud https://wazuh.com/cloud I run an in-house deployment using the Docker conf they supply. It requires a couple of hours per month and mainly a lot of disparate skills. The real thing that takes time is the installation and configuration of the rules and agents. That’s something that you have to do for any SIEM really, irrespective of open source / paid: you have to understand your nominal feed and that takes time.
• yabones 2y ago
  Sadly OSSEC is largely abandoned. Back in the day it was very good for a lightweight and effective security system for those that didn't want to install full-blown antivirus on everything. I wish they would donate the project to Linux Foundation or CNCF, but it seems destined for decline.
  • bluepuma77 2y ago
    It seems their official Docker image is 5 years old.
• valyala 2y ago
  It would be great to be able to use VictoriaLogs underneath instead of Elasticsearch. This would simplify the configuration and maintenance, since VictoriaLogs works optimally with default configs on any hardware. This will also help reducing hardware costs for large amounts of stored security logs, since VictoriaLogs usually needs up to 30x less RAM and up to 15x less disk space than Elasticsearch for the same amounts of logs. See https://itnext.io/how-do-open-source-solutions-for-logs-work-elasticsearch-loki-and-victorialogs-9f7097ecbc2f https://itnext.io/how-do-open-source-solutions-for-logs-work... for details.