What's your favorite rules?

[namobud...@gmail.com]

I was wondering what are some key ways folks are using OSSEC and any custom rules and decoders which you might use?

I'm trying to come up with some general best-practice ways folks customize OSSEC.

Thanks!