All Apps and Add-ons

OSSEC Custom Rule Groups


Splunk isnt detecting my custom rule groups. Any idea how to fix it?

0 Karma


So far I figured out that by copying the to the ossec server and running it, then copying the output csv back to the Splunk machine and restarting Splunk, resolved the issue.

Any more of an automated approach would be helpful. Obviously, this would have to be done each time a new custom rule group is created.

0 Karma


This is indeed the correct way to do it.

The app ships with the latest rule groups from the OSSEC distribution at the time of each app version release, but yes, you'll need to update it for local rule changes.

Did you have anything in particular in mind as a more automated approach?

0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...