Proposed start of OSSEC info

Not sure the best place to put this in the doc but  here is a start.