The behavioral monitoring capabilities of OSSEC allow you to identify unusual or anomalous user activities that fall outside of your baseline or “normal” operations. Suspicious events, such as changes to AD or local groups, AD or local policies, the creation, deletion or modification of a significant number of user accounts or AD groups, etc.

OSSEC integrates in our SIEM and centralized log magamenet solution, so you can identify and investigate security incidents from a single system. Security events from all OSSEC agents installed in your critical servers along with all across monitored environments are aggregated and correlated. When security incidents are detected you have full visibility of the targeted assets.