Archive

Looking for RedHat app and add-on recomendations.

Path Finder

Hello,

We are going to import RedHat web logs into Splunk for security monitoring. I was just wondering if anyone had any recommendations, based on your own experience, on apps I can use to make this process easier. So far, I've looked at Linux Auditd, Splunk App for Unix and Linux, and Red Hat Storage App for Splunk Enterprise (which I don't think fits my purposes). I just wanted to get other people's opinions on these apps, as well as hear any suggestions you have for alternatives.

If it matters, we are going to be using the logs for security, particularly in regards to detecting brute force attacks and privilege escalation.

Thank you.

0 Karma
1 Solution

Contributor

NMON for Splunk along with Auditd is a fav of mine for all *NIX variants also Fail2Ban if your going that route on your Linux hosts .

View solution in original post

Contributor

NMON for Splunk along with Auditd is a fav of mine for all *NIX variants also Fail2Ban if your going that route on your Linux hosts .

View solution in original post