RSA Admin

Created UDS for OSSEC, it validates fine, but envision won't use it.

Discussion created by RSA Admin Employee on Dec 15, 2010
Latest reply on Jul 19, 2011 by RSA Admin

Granted, I haven't parsed every single rule, but I've parsed the ones that trigger the most.

I've validated it using the 1.1.1 version of the integrator and everything parses.

I install it to envision, and it ignores it.

 

I've attempted to force it to use the ossec device, but it just ends up generating a new unkown entry.

I've attached my deployment package. The version of OSSEC I'm using is the latest version available on the website. 

2.5.1

Any help would be greatly appreciated.

Attachments

Outcomes