<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Anthony Reinke &#187; ossec</title>
	<atom:link href="http://www.anthonyreinke.com/tag/ossec/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.anthonyreinke.com</link>
	<description>Just getting a few things out of my head</description>
	<lastBuildDate>Tue, 31 Aug 2010 02:55:21 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>RegEx with Splunk for OSSEC</title>
		<link>http://www.anthonyreinke.com/2009/07/30/regex-with-splunk-for-ossec/</link>
		<comments>http://www.anthonyreinke.com/2009/07/30/regex-with-splunk-for-ossec/#comments</comments>
		<pubDate>Fri, 31 Jul 2009 04:12:46 +0000</pubDate>
		<dc:creator>Anthony</dc:creator>
				<category><![CDATA[security]]></category>
		<category><![CDATA[expression]]></category>
		<category><![CDATA[ossec]]></category>
		<category><![CDATA[regex]]></category>
		<category><![CDATA[regular]]></category>
		<category><![CDATA[splunk]]></category>

		<guid isPermaLink="false">http://www.anthonyreinke.com/?p=75</guid>
		<description><![CDATA[Thanks to Michael Wilde for the information on RegEx in Splunk.  For those like me who aren't the best at RegEx, I will show some of the regular expressions I am using for OSSEC. Server Name (?i) Location:\s\((?P&#60;FIELDNAME&#62;.*?)\)\s Windows Event User (?i) USER: (?P&#60;FIELDNAME&#62;[^:]*); Server IP (?i)^[^\)]*\)\s+(?P&#60;FIELDNAME&#62;[^\-]*)\- Windows Events (?i)^[^\-]*\-\s+(?P&#60;FIELDNAME&#62;[^\.]*)\. LogInUser (?i) Name: (?P&#60;FIELDNAME&#62;\w+) LogInDomain [...]]]></description>
		<wfw:commentRss>http://www.anthonyreinke.com/2009/07/30/regex-with-splunk-for-ossec/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>OSSEC and Splunk</title>
		<link>http://www.anthonyreinke.com/2009/07/27/ossec-and-splunk/</link>
		<comments>http://www.anthonyreinke.com/2009/07/27/ossec-and-splunk/#comments</comments>
		<pubDate>Tue, 28 Jul 2009 01:55:54 +0000</pubDate>
		<dc:creator>Anthony</dc:creator>
				<category><![CDATA[security]]></category>
		<category><![CDATA[event]]></category>
		<category><![CDATA[hids]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[logs]]></category>
		<category><![CDATA[ossec]]></category>
		<category><![CDATA[splunk]]></category>
		<category><![CDATA[syslog]]></category>
		<category><![CDATA[unix]]></category>
		<category><![CDATA[windows]]></category>

		<guid isPermaLink="false">http://www.anthonyreinke.com/?p=66</guid>
		<description><![CDATA[I have been playing with OSSEC and Splunk.  OSSEC is a Host based Intrusion Detection System (HIDS).  Splunk is a log archiving and searching system.  OSSEC is open source and is multiple platform.  You can run it on Linux/Unix and Windows.  I am using OSSEC to forward Windows Event Logs to Splunk.  Splunk makes the [...]]]></description>
		<wfw:commentRss>http://www.anthonyreinke.com/2009/07/27/ossec-and-splunk/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>
