Hi all, Lets say that I want to forward the logs of an OSSEC Server, to a commercial SIEM. So, in that case how can I install OSSEC agent to forward all logs to SIEM.
Also, what we shud do is Step1: Modify the syslog.conf of the OSSEC Server, and redierct all the logs in the /var/log/messages and /var/log/authlog etc to local7 utility, and from that local7 utility, we shud forward the logs to the SIEM IP. It is sth like this: /var/log/messages <tab_space> local7.* /var/log/authlog <tab_space> local7.* local7.* <tab_space> @SIEM_IP I am not sure that whether it will work or not. Pls correct me if I am wrong Regards Tanishk On Tue, Feb 1, 2011 at 9:28 PM, ash kumar <[email protected]> wrote: > Mike, > > > I would like to forward some of the logs (MS Event Logs) to another > > Log management appliance. > > You have a few options here. You can use something like Snare, which can > selectively forward logs, or you can use the OSSEC agent to forward all > logs and then send only some of them into the SIEM. > > There are several other options for forwarding logs to a commercial SIEM > including onee natively provided by the manufacturer. However, there is a > lot of additional value in the OSSEC agent (including file integrity, > Intrusion detection rules, categorizing alerts etc.,) that can not be > supplemented. Having multiple agents on each server is not worth the > processing, network overhead cost and I believe being able to use the ossec > agent is a very elegent and comprehensive solution ( I would add wmi queries > to the rules engine though). I have ditched Snare in favor of ossec agents > actually. > > > This problem breaks down into two parts. > > 1. Selectively forward syslogs --> This is easily configured in > > ossec.conf > > Well, to be clear: when you do this in OSSEC, you're really forwarding > alerts. Do you want to send raw logs or alerts? > > Raw logs actually, because I can handle alerts quite elegantly by email. > Raw logs forwarded to a SIEM allows me to archive data, carry out trending > analysis and periodic reporting well. > > > 2. Strip ossec specific parts of the log and forward the rest to the > > log management appliance which can parse native Event Logs. > > I have done this with syslog-ng. I never completed it fully but when/if > I do I will post a how-to. > > That is a good idea. I will try it too. > > > Thanks for your time and attention > > > Ash Kumar > > > -- warm regards Tanishk Lakhaani
