HIDS—OSSEC Software and Support

ITS >> IT Security >> Servers >> HIDS >> OSSEC Software and Support

OSSEC Software and Support

OSSEC is ITS’s recommendation for Macintosh servers that contain private data. Windows, Unix/Linux servers need to use Tripwire Enterprise.

Acquiring OSSEC software and licenses

To get OSSEC for the first time, follow the procedures below:

1. Attend a training session.
2. After you attend training, download the software:
1. Go to www.ossec.net
2. Click on the Downloads tab
3. Download the software titled “Unix/Linux Version”, which will work for Macintosh servers.
4. Install OSSEC on each Macintosh Internet facing server you administer.

OSSEC recommended practices

ITS had developed the following recommended practices to help you use OSSEC effectively.

• Starting configuration
• General practices
• Managing alerts

OSSEC self-help

• OSSEC manuals on reserve in Norlin Library
• ITS has placed the vendor’s OSSEC manuals on reserve in Norlin Library. You can check out the manuals at the reference desk under course number HIDS 1000.
• OSSEC training presentation in PDF format.

OSSEC Support from ITS

ITS will only provide OSSEC escalated support to administrators who have taken the OSSEC training. To get help call the IT Service Center at 303-735-4357 (5-HELP from an on-campus phone).

Contact Information
Campus IT Security Office
(303) 735-HELP
security@colorado.edu