topic Re: Splunk & Ossec intergration in Monitoring Splunk

Splunk & Ossec intergration

monitor — Sat, 01 May 2010 02:38:24 GMT

Splunk seems like an all around tool.

What is the advantage of incorporating the Ossec system into or with Splunk?

Re: Splunk & Ossec intergration

rayfoo — Wed, 05 May 2010 19:10:57 GMT

One that i can think of is that you can summarize data, or customize reports from Splunk, using OSSEC as an input.

Re: Splunk & Ossec intergration

esweeney — Thu, 09 Sep 2010 05:26:28 GMT

Users incorporate OSSEC alerts into Splunk to eliminate the need for a dedicated OSSEC web interface and allow for simplified incident analysis through aggregation and correlation.

Check out the app on Splunkbase: http://www.splunkbase.com/apps/All/4.x/app:Splunk+for+OSSEC+-+Splunk+v4+version

And an older blog detailing the value one company finds: http://www.ossec.net/main/splunk-ossec-integration

Re: Splunk & Ossec intergration

jhuebner — Thu, 21 Oct 2010 00:51:39 GMT

The reporting and searching is much easier using SPLUNK to look at & do searches on the OSSEC data. The newest version of SPLUNK and the OSSEC plugin give you a whole new set of features.

I've not updated to the 2.5.1 version, I'm still on 2.4, but I think I'll give it a try, x.x.1 just came out.