All Apps and Add-ons

Splunk Add-on for OSSEC: Is there a way with OSSEC to monitor when software is installed?

nickbijmoer
Path Finder

Hello,

Is there a way with OSSEC to monitor when software is being installed?

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

If you are looking to integrate w ES, the ossec_file_integrity_monitoring source type maps to change analysis and the ossec_alert maps to alert data model.

You could adapt some of the existing correlation searches that use change analysis to fit this need or use the guided search to build a correlation search. You will want to think about how often you want to be alerted to these changes and if there is a certain threshold you would want to set.

0 Karma

nickbijmoer
Path Finder

Im trying to integrate it in Splunk enterprise, since we dont have enterprise security here, is it also possible on enterprise edition?

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

Yes. You can use the common information model and and the associated TA on splunkbase https://splunkbase.splunk.com/app/2808/ and build a datamodel search using the change analysis data model or you can just take the ossec data in and then build some searches based on what you see.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@nickbijmoer - Are you using the Splunk Add-on for OSSEC? I just want to make sure your post is tagged correctly. Thank you.

0 Karma

nickbijmoer
Path Finder

@aaraneta, Yes I use the splunk add-on for ossec.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...