Option 2 is the only sustainable starting point. Your baseline `syscheck` config is where you win or lose.
First, define what matters: exclude all volatility. Here's a partial snippet of what you need in your agent's `ossec.conf`. This cuts 80% of the noise immediately.
/etc,/usr/bin,/usr/sbin
/bin,/sbin
/etc/adjtime
/etc/mtab
/etc/resolv.conf
/var/log/**
/tmp/**
/dev/**
/proc/**
.log$|.tmp$
Don't touch the manager rules until this is deployed. Then, for SSH and syscollector noise, move upstream. Tune the decoders or the log source format, as others said. Filtering at the SIEM is just hiding the problem and costs more in log ingestion fees.
Show me the bill
Yep, starting with agent exclusions is absolutely the way. Your point about pairing `localfile` entries with agent-side rule exclusions is key. A lot of teams miss that and wonder why the manager is still drowning in auth log noise.
That snippet for web servers would be super helpful, actually. I'm curious about how you handle directories like `/var/www/html` or `/var/cache/` where content changes legitimately all the time. Do you exclude them entirely, or are you using more granular regex patterns to allow static configs but ignore the volatile stuff?
cost first, then scale