Atomicorp

Go into /var/ossec/etc/ossec.conf and locate <remote> verify that port is set to 1514. If it is not, set the port. Also go to <auth> and set port to 1515. Save the changes and then restart the ossec-hids process

Does the ossec.log show any prominent errors in regards to the affected agents?

Pleas try installing the following packages as well:

Extract pcre2-10.32.tar.gz to src/external.

Get it here: https://ftp.pcre.org/pub/pcre/pcre2-10.32.tar.gz

Correct. CentOS 8 is out in December and CentOS 7 is good through 2024. You can however switch to Rocky Linux which is CentOS8 equivilent

Good morning,

What errors do you see in the ossec.log?

Yes, you can use aum. Have you tried changing your password? You can do so here or I can do so manually for you
https://www.atomicorp.com/amember/login

<directories check_all="yes">E:\.</directories>

The \ should be a / so can you give that a try please?

<directories check all="yes">e:/<directories>

Can you verify that kibana is running with ps ax | grep kibana

Also, if you could grep "kibana" /var/log/messages
to see if any errors occur there

So is everything working properly now?

Do you have an error output that you are seeing after having updated the Kibana service?

OSSEC supports sending diffs when changes are made to text files on Linux and unix systems. Configuring syscheck to show diffs is simple, add report_changes="yes" to the <directories option. For example: <syscheck> <directories report_changes="yes" check_all="yes">/etc<...

Yes! You will need to vim into /var/ossec/etc/ossec.conf and modify the file to include what directories you would like to watch: <!-- Directories to check (perform all possible verifications) --> <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> <directories check_all=&qu...

Verify that you can ping the server box from the agent. A lot of times, when the HUB cannot detect the agent, it is because of either a firewall or a closed port.

Here are the documents for connecting agents to the HUB. https://www.ossec.net/docs/docs/manual/agent/index.html

If you would like to try changing the password for the account, you can do so here:
www.atomicorp.com/amember/login

Once changed, update the oum.conf directly and then try and run oum update