Question: Complete the following challenge and upload your screenshot proof. Task 1 and 2 of the HIDS OSSEC lab should be completed for this problem. A

Complete the following challenge and upload your screenshot proof. Task 1 and 2 of the HIDS OSSEC lab should be completed for this problem. A malicious actor got onto the server and in an attempt to cover their tracks they wiped /var/log/auth.log this can easily be done by redirecting nothing into the file, assuming you have permissions. For example ">/var/log/auth.log" The problem is that OSSEC did not detect it because of a configuration error. Fix the error and restart OSSEC. Hint: look closely at the ossec.conf file around where authlog is defined, might be a typo. Fix the problem and restart OSSEC. Wipe or modify the /var/log/auth.log file like our attacker did. Show screen shot proof of the Thunderbird email showing the

Step by Step Solution

There are 3 Steps involved in it

1 Expert Approved Answer
Step: 1 Unlock blur-text-image
Question Has Been Solved by an Expert!

Get step-by-step solutions from verified subject matter experts

Step: 2 Unlock
Step: 3 Unlock

Students Have Also Explored These Related Databases Questions!