###
OUM
###

OSSEC Updater Modified (OUM) downloads and applies Atomicorp OSSEC CRS rules and
Atomicorp threatfeed updates on systems running the Atomicorp ``ossec-hids-server``
package.


Introduction
============

OUM is a small command-line tool that:

* Authenticates to ``updates.atomicorp.com`` with your Atomicorp subscription
* Downloads OSSEC CRS rule/decoder packages into ``/var/ossec/etc/rules.d`` and
  ``/var/ossec/etc/decoders.d``
* Downloads Atomicorp threatfeed lists into ``/var/ossec/etc/lists/threat/``
* Verifies rule updates with ``ossec-analysisd -t`` and restarts OSSEC when
  updates are applied

OUM is part of the free Atomic (Atomic Rocket Turtle) community packaging set.
It is separate from :doc:`AUM </aum/index>` (Atomic Update Manager), which updates
ModSecurity / Atomic Protector rule feeds.


Supported platforms
===================

Packaged builds are published for:

* Rocky Linux / RHEL / CentOS compatible: 8, 9, 10
* Amazon Linux 2023
* Fedora 43 and 44
* Ubuntu 22.04 (jammy), 24.04 (noble), 26.04 (resolute)
* Debian 13 (trixie)


Installation
============

1. Install Atomicorp OSSEC HIDS server (``ossec-hids-server``).

2. Install OUM with the dedicated installer (configures the Atomic repo and
   installs the package):

   .. code-block:: console

      curl -fsSL -o /tmp/oum-installer.sh https://updates.atomicorp.com/installers/oum
      # Review the script, then:
      bash /tmp/oum-installer.sh

   Or enable the Atomic repository first, then install the package:

   .. code-block:: console

      curl -fsSL -o /tmp/atomic-installer.sh https://updates.atomicorp.com/installers/atomic
      # Review the script, then:
      bash /tmp/atomic-installer.sh

      # RPM-based systems
      dnf install oum
      # or: yum install oum

      # Debian / Ubuntu
      apt-get update
      apt-get install oum


Configuration
=============

Run the interactive configurator once to store subscription credentials in
``/var/ossec/etc/oum.conf``:

.. code-block:: console

   oum configure

The file also supports an optional ``EXCLUDE_RULES`` space-separated list of CRS
rule filenames to remove after each rules update.


Usage
=====

.. code-block:: console

   oum list                 # show pending updates
   oum update               # apply updates (interactive confirmation)
   oum -y update            # apply updates non-interactively
   oum -d update            # debug output
   oum version
   oum help

``upgrade`` is an alias for ``update``.


OSSEC configuration notes
=========================

OUM expects modern Atomicorp ``ossec.conf`` layouts that load directories:

.. code-block:: xml

   <rules>
           <decoder_dir pattern=".xml$">etc/decoders.d</decoder_dir>
           <rule_dir pattern=".xml$">etc/rules.d</rule_dir>
           <list>etc/lists/audit-key</list>
           <!-- Declare each threat list file when using the threatfeed, for example: -->
           <!-- <list>etc/lists/threat/threat1</list> -->
   </rules>

If ``decoder_dir`` / ``rule_dir`` are missing, ``oum update`` prints a warning.
Legacy configs that only ``<include>`` individual rule files will ignore OUM
installs under ``rules.d`` / ``decoders.d``.

After a threatfeed update, OUM runs ``ossec-makelists`` when that binary is
present. Threat list entries must still be declared in ``ossec.conf`` for
analysisd to use them.


Support
=======

Community packages in the Atomic repository are unsupported. Questions may be
posted in the community forums:

https://forums.atomicorp.com/
