/var/ossec/rules/local_rules.xml
/var/ossec/etc/ossec.conf
/var/ossec/etc/internal_options.conf