Monitoring Wazuh and / or Ossec
I was wondering if anyone out there is using LM to monitor Wazuh and / or Ossec-hids in any way. I am particularly interested in monitoring to see if the agent gets disconnected from the Manager. ...
Forum Discussion
Yes I searched the exchange and I even googled it and found nothing.
As for scripting. I did figure out how to enable Linux Process monitoring and with that I am able to see the processes including the bunch of them that make up Wazuh/Ossec on a client. My current thought right now is to create a job or cron or use Filebeat/Logstash (or something else) that can watch the logs for a disconnect. Then either set an alarm via SNMPTrap, or maybe stop Wazuh/Ossec on the host which can be caught by LM.
Or thats my initial thought since from what I can tell Wazuh / Ossec does not report to SNMP at all.
