Solved: OSSEC App and the Common Information Model - Splunk Community

Splunk Enterprise Security

I am a fan on the OSSEC app, however to make proper use of it in my eyes it needs to be integrated with the Common Information Model.

Has anybody already integrated the OSSEC appp with Common Information Model i.e. field extractions and tags etc.

Thanks

1 Solution

Solution

There's a TA for it in Enterprise Security -- getting that onto Apps is on the to-do list. Note that this is a long list and timing is TBD.

View solution in original post

Solution

There's a TA for it in Enterprise Security -- getting that onto Apps is on the to-do list. Note that this is a long list and timing is TBD.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...