Hello Ash, On 01/24/2011 03:35 PM, ash kumar wrote:
I would like to forward some of the logs (MS Event Logs) to another Log management appliance.
You have a few options here. You can use something like Snare, which can selectively forward logs, or you can use the OSSEC agent to forward all logs and then send only some of them into the SIEM.
This problem breaks down into two parts. 1. Selectively forward syslogs --> This is easily configured in ossec.conf
Well, to be clear: when you do this in OSSEC, you're really forwarding alerts. Do you want to send raw logs or alerts?
2. Strip ossec specific parts of the log and forward the rest to the log management appliance which can parse native Event Logs.
I have done this with syslog-ng. I never completed it fully but when/if I do I will post a how-to.
It is the second part that I have not been able to figure out. I suspect this would involve a perl script stripping and forwarding the logs. has anyone tried this?
Depending on how you want to go about this, another option is to have a syslog reader read the OSSEC queue on the manager. This explains how to do that: http://www.immutablesecurity.com/index.php/2010/01/29/using-ossec-for-encrypted-log-transport/
Hope this helps. -Mike
