OUM

OSSEC Updater Modified (OUM) downloads and applies Atomicorp OSSEC CRS rules and Atomicorp threatfeed updates on systems running the Atomicorp ossec-hids-server package.

Introduction

OUM is a small command-line tool that:

  • Authenticates to updates.atomicorp.com with your Atomicorp subscription

  • Downloads OSSEC CRS rule/decoder packages into /var/ossec/etc/rules.d and /var/ossec/etc/decoders.d

  • Downloads Atomicorp threatfeed lists into /var/ossec/etc/lists/threat/

  • Verifies rule updates with ossec-analysisd -t and restarts OSSEC when updates are applied

OUM is part of the free Atomic (Atomic Rocket Turtle) community packaging set. It is separate from AUM (Atomic Update Manager), which updates ModSecurity / Atomic Protector rule feeds.

Supported platforms

Packaged builds are published for:

  • Rocky Linux / RHEL / CentOS compatible: 8, 9, 10

  • Amazon Linux 2023

  • Fedora 43 and 44

  • Ubuntu 22.04 (jammy), 24.04 (noble), 26.04 (resolute)

  • Debian 13 (trixie)

Installation

  1. Install Atomicorp OSSEC HIDS server (ossec-hids-server).

  2. Install OUM with the dedicated installer (configures the Atomic repo and installs the package):

    curl -fsSL -o /tmp/oum-installer.sh https://updates.atomicorp.com/installers/oum
# Review the script, then:
bash /tmp/oum-installer.sh

    Or enable the Atomic repository first, then install the package:

    curl -fsSL -o /tmp/atomic-installer.sh https://updates.atomicorp.com/installers/atomic
# Review the script, then:
bash /tmp/atomic-installer.sh

# RPM-based systems
dnf install oum
# or: yum install oum

# Debian / Ubuntu
apt-get update
apt-get install oum

Configuration

Run the interactive configurator once to store subscription credentials in /var/ossec/etc/oum.conf:

oum configure

The file also supports an optional EXCLUDE_RULES space-separated list of CRS rule filenames to remove after each rules update.

Usage

oum list                 # show pending updates
oum update               # apply updates (interactive confirmation)
oum -y update            # apply updates non-interactively
oum -d update            # debug output
oum version
oum help

upgrade is an alias for update.

OSSEC configuration notes

OUM expects modern Atomicorp ossec.conf layouts that load directories:

<rules>
        <decoder_dir pattern=".xml$">etc/decoders.d</decoder_dir>
        <rule_dir pattern=".xml$">etc/rules.d</rule_dir>
        <list>etc/lists/audit-key</list>
        <!-- Declare each threat list file when using the threatfeed, for example: -->
        <!-- <list>etc/lists/threat/threat1</list> -->
</rules>

If decoder_dir / rule_dir are missing, oum update prints a warning. Legacy configs that only <include> individual rule files will ignore OUM installs under rules.d / decoders.d.

After a threatfeed update, OUM runs ossec-makelists when that binary is present. Threat list entries must still be declared in ossec.conf for analysisd to use them.

Support

Community packages in the Atomic repository are unsupported. Questions may be posted in the community forums:

https://forums.atomicorp.com/