Question: Complete the following challenge and upload your screenshot proof. Task 1 and 2 of the HIDS OSSEC lab should be completed for this problem. A
Complete the following challenge and upload your screenshot proof. Task and of the HIDS OSSEC lab should be completed for this problem. A malicious actor got onto the server and in an attempt to cover their tracks they wiped varlogauthlog this can easily be done by redirecting nothing into the file, assuming you have permissions. For example varlogauthlog The problem is that OSSEC did not detect it because of a configuration error. Fix the error and restart OSSEC. Hint: look closely at the ossec.conf file around where authlog is defined, might be a typo. Fix the problem and restart OSSEC. Wipe or modify the varlogauthlog file like our attacker did. Show screen shot proof of the Thunderbird email showing the
Step by Step Solution
There are 3 Steps involved in it
1 Expert Approved Answer
Step: 1 Unlock
Question Has Been Solved by an Expert!
Get step-by-step solutions from verified subject matter experts
Step: 2 Unlock
Step: 3 Unlock
