I'm not sure if this app is being maintained by the author anymore but I've noticed that there's a bug (syntax error) in the 'search' parameter for the 'OSSEC - Track Expected Hosts' saved search.
The search parameter starts with '| metadata host | ...' but, as far as I can tell, this should be '| metadata type=host | ...'
