https://www.guiadoti.com/2017/08/ossec-active-response-hids-parte-8/