OSSEC's configuration is mainly read from an XML file called ossec.conf. You can directly control the contents of this file using node attributes under node['ossec']['conf']. These attributes are mapped to XML using Gyoku. See the Gyoku site for details on how this works. Chef applies attributes from all attribute files regardless of which recipes were executed. In order to make wrapper cookbooks easier to write, node['ossec']['conf'] is divided into the three installation types mentioned below, local, server, and agent. You can also set attributes under all to apply settings across all installation types. The typed attributes are automatically deep merged over the all attributes in the normal Chef manner.