Mike, > I would like to forward some of the logs (MS Event Logs) to another > Log management appliance.
You have a few options here. You can use something like Snare, which can selectively forward logs, or you can use the OSSEC agent to forward all logs and then send only some of them into the SIEM. There are several other options for forwarding logs to a commercial SIEM including onee natively provided by the manufacturer. However, there is a lot of additional value in the OSSEC agent (including file integrity, Intrusion detection rules, categorizing alerts etc.,) that can not be supplemented. Having multiple agents on each server is not worth the processing, network overhead cost and I believe being able to use the ossec agent is a very elegent and comprehensive solution ( I would add wmi queries to the rules engine though). I have ditched Snare in favor of ossec agents actually. > This problem breaks down into two parts. > 1. Selectively forward syslogs --> This is easily configured in > ossec.conf Well, to be clear: when you do this in OSSEC, you're really forwarding alerts. Do you want to send raw logs or alerts? Raw logs actually, because I can handle alerts quite elegantly by email. Raw logs forwarded to a SIEM allows me to archive data, carry out trending analysis and periodic reporting well. > 2. Strip ossec specific parts of the log and forward the rest to the > log management appliance which can parse native Event Logs. I have done this with syslog-ng. I never completed it fully but when/if I do I will post a how-to. That is a good idea. I will try it too. Thanks for your time and attention Ash Kumar
