Elaborate on OSSEC alert instructions

Addresses #788 
Need to make edits to install.md to account for new document
nit: while OSSEC has an active response feature we do not currently enable it. The default actions don't work with our environment because they are IP based and all of our traffic is over tor.

Might also want to mention that it is a server-agent setup.