Splunk Add-on for OSSEC: Is there a way with OSSEC to monitor when software is installed?

[nickbijmoer]

Hello,

Is there a way with OSSEC to monitor when software is being installed?

[jstoner_splunk]

If you are looking to integrate w ES, the ossec_file_integrity_monitoring source type maps to change analysis and the ossec_alert maps to alert data model.

You could adapt some of the existing correlation searches that use change analysis to fit this need or use the guided search to build a correlation search. You will want to think about how often you want to be alerted to these changes and if there is a certain threshold you would want to set.

[nickbijmoer]

Im trying to integrate it in Splunk enterprise, since we dont have enterprise security here, is it also possible on enterprise edition?

[jstoner_splunk]

Yes. You can use the common information model and and the associated TA on splunkbase https://splunkbase.splunk.com/app/2808/ and build a datamodel search using the change analysis data model or you can just take the ossec data in and then build some searches based on what you see.

[aaraneta_splunk]

@nickbijmoer - Are you using the Splunk Add-on for OSSEC? I just want to make sure your post is tagged correctly. Thank you.

[nickbijmoer]

@aaraneta, Yes I use the splunk add-on for ossec.