icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

staging environment

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Reporting and Management for OSSEC
SHA256 checksum (reporting-and-management-for-ossec_1189.tgz) 8149d22e685fe073997ebdf9f73c4a966d133c309341ad916dc438c466ba7145 SHA256 checksum (reporting-and-management-for-ossec_1188.tgz) 4a8385cdb046d796cce26f4754be853ac971f713d881ebced8f00f3e0524b860 SHA256 checksum (reporting-and-management-for-ossec_1185.tgz) 4ad0406530f9a05c948d81056741f870ef067f0320a563b3e3b66de9243bf504 SHA256 checksum (reporting-and-management-for-ossec_1184.tgz) adf2d08f2ed6fa13ebcead272262e790817494519e08abbd547634f75eb49567 SHA256 checksum (reporting-and-management-for-ossec_1181.tgz) 22fce80a801016bcf5573876e7240bb056fccfc3fc0ca6727740f4c93beecc41 SHA256 checksum (reporting-and-management-for-ossec_1180.tgz) 4060e1edff02dc479f8b59f65fe05b6da43d0daf68f3547fbcafc6acbb8afe69 SHA256 checksum (reporting-and-management-for-ossec_1179.tgz) e1d275629e83c9c0d0df1a91fbace69fd6590b7363d6cbe962abf298e568b82b SHA256 checksum (reporting-and-management-for-ossec_1177.tgz) 674c56142a1f751af49364c2ffcdd345f76df86c216465eeb2e9def1f5d21dd2 SHA256 checksum (reporting-and-management-for-ossec_1175.tgz) 8a707232e12ddb370e84d9648334122d2a8c0b8164939d31d2158f57dd5b145a SHA256 checksum (reporting-and-management-for-ossec_1026.tgz) c49256473e085e897ca8c755ec4a039a76ebce84db88a69fd31e38e37b453d8e
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

Reporting and Management for OSSEC

Splunk Cloud
This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
This package was formally named Splunk for OSSEC (renamed to meet new Splunk trademark guidelines).

This package contains parsing logic, saved searches, and dashboards for monitoring the OSSEC Host-based Intrusion Detection System via Splunk. Support for managing agent keys via is also provided.

Please read the Installation section - the app WILL NOT WORK without configuration.

Overview


This package contains parsing logic, saved searches, and dashboards for monitoring the OSSEC Host-based Intrusion Detection System via Splunk.

Please read the Installation section below - the app will not work correctly without configuration.

Some functionality, primarily agent management, is not currently supported when Splunk is running on Windows.

Installation


To install, extract the .tgz archive in $SPLUNK_HOME/etc/apps

You may need to enable the appropriate inputs, either via inputs.conf, or through the Manager in the Splunk GUI.

The application maintains a list of all known OSSEC servers in a lookup table. When you first install, this list will be empty except for a wildcard ntry. You can wait until it is populated automatically, or run OSSEC - Rebuild OSSEC Server Lookup Table from the Searches & Reports -> Utility menu.

Upgrading


This version introduces a number of changes, particularly from version 1.0 (see the CHANGES file). The recommended procedure is to remove the old app before installing. Installing over top of older versions should (mostly) work, but may cause some problems.

Data Inputs


Sample input declarations are included with the application, but are disabled by default. These may be enabled either in inputs.conf, or via the Manager.

Several data input methods are available:

  1. Native syslog daemon, writing to flat files which are indexed by Splunk.
  2. Syslog-style input directly to Splunk
  3. Direct monitoring of OSSEC alert logs. Typically requires Splunk to be installed on the OSSEC server.
  4. Scripted input to periodically check the status of OSSEC agents by running ossec_agent_control -l, either locally or on a remote system.

For options (1) and (2), set the sourcetype to 'ossec'.
For option (3), set the sourcetype to 'ossec_alerts'.
For option (4), set the sourcetype to 'ossec_agent_control'.

Collection of OSSEC agent Operational Status:


To collect OSSEC agent status, you will need to be able run the agent_control command without a password.

For local OSSEC servers using the default path, this is configured by default. For non-standard install paths, you will need to edit ossec_servers.conf.

For remote execution, see below.

Managing Agent Keys from Splunk


To enable key management, you will need to be able to run the manage_agents command without a password. You will also need to be a member of either the Splunk Admin role or the OSSEC Admin role.

This feature is not enabled by default for security reasons. You can enable it by editing ossec_servers.conf.

For remote execution, see below.

Enabling Remote Execution


For remote agent status collection and remote management, you can use SSH and sudo to avoid password prompts.

The Splunk service account (root by default) will need to be able to log into the OSSEC server as a user with permissions to run the following commands without being prompted for a password:
agent_control -l
manage_agents

For more detailed instructions, consult Splunk Answers:
http://splunk-base.splunk.com/answers/42717/how-do-i-enable-remote-agent-management-in-splunk-for-ossec

Agent Coverage Tracking


At present, the agent coverage dashboard currently relies on agent status information from the agent_control command (see above). A Splunk Enterprise license is needed for the scheduled searches.

To use agent coverage tracking, you must populate a lookup table that tracks all hosts that should be monitored by OSSEC. By default, all hosts seen by Splunk in the last 30 days will be expected.

Edit the saved search OSSEC - Track Expected Hosts to configure your own list. For example, all servers or all members of a particular LDAP container.

Malware Alerting


Alerting on malware file hashes only works when Splunk is directly monitoring the ossec alerts log (Syslog-based logging does not include the hashes).

If you are using this method, you can configure your email address and enable the alert from the Manager.

The MD5 and SHA1 file hashes will be sent to a third party (Team Cymru) for validation.

No guarantees of accuracy are provided.

3rd-Party Components / Disclaimers


This app includes third-party components and/or interfaces with third-party services. See the 3rdparty directory for details.

OSSEC is a product of Daniel Cid and Trend Micro. The app author is not afilliated with Trend Micro.

Splunk for OSSEC neither supported nor endorsed by Trend Micro or the OSSEC developers. The author makes no warranties or
guarantees of any kind. Use is at your own risk.

Release Notes

Version 1.1.89
March 14, 2012

Version 1.1.89

  • Fixed a bug in ossec_agent_status that could prevent agent status polling from working correctly in certain configurations.

  • Increased timeout on agent status polling from 5 to 30 seconds

  • Updated rule group lookup table with rules from latest OSSEC build on BitBucket.

  • Removed unused Intersplunk dependency from pyOSSEC to ease command-line testing.

Version 1.1.88
June 17, 2011

Version 1.1.88

  • Added indexing of ossec.log file when Splunk is installed on the
    OSSEC server.

  • Added saved search to re-initialize ossec server lookup table

  • Bugfixes / parsing improvements when working with local alerts file
    (when Splunk is installed directly on the OSSEC server)

  • Improved suppression of Windows event explanatory text when working
    with local alerts file (Splunk installed directly on OSSEC server)

Version 1.1.85
June 12, 2011

Version 1.1.85

  • Re-scoped Navigation menu to avoid clobbering menus in other app
    views.

  • Updated rule group lookup table with rules from OSSEC 2.6 beta

  • Modified rule group lookup generating script to accept rules directory
    as a parameter

  • Added indexing of Active Response logs when Splunk is installed on the
    OSSEC server

  • Fixed an issue in the Agent Management view that could cause the
    list of managed servers to appear empty.

  • Removed local.meta file that had accidentally slipped into the
    distribution.

  • Corrected CSS formatting in Agent Coverage view.

Version 1.1.84
April 5, 2011

Version 1.1.84

  • Corrected stats calculation for Top 10 views

  • Added triggers entry in app.conf

  • Resolved a display error affecting File Integrity view with Splunk 4.2

  • Added workflow action for VirusTotal hash lookups

  • Minor bugfixes

Version 1.1.81
Feb. 23, 2011

Version 1.1.81

  • Fixed cron_schedule entry for lookup table generating search
  • Fixed startup warnings for Splunk 4.2
Version 1.1.80
Feb. 17, 2011

Version 1.1.80

  • Improved error reporting in ossec_agent_status script.
Version 1.1.79
Dec. 15, 2010

Version 1.1.79

  • Stripped out explanatory text on Microsoft-Windows-Security-Auditing events
    ("This event is generated when...")

  • Extracted EventCode, LogName, SourceName, and Type for Windows events

Version 1.1.77
Oct. 11, 2010

Version 1.1.77

  • Added Event Renderer for high-severity events (modify the eventtype to tune threshold)

  • Better handling of agent management connection errors

  • Increased default timeouts on agent connection

Version 1.1.75
Oct. 7, 2010

Version 1.1.75

  • Updated rule group lookup table to match OSSEC 2.5 ruleset

  • Increased results shown on agent management dashboard from 10 to 15

  • Modified Event Search view to better handle events with no ossec_group.

  • Fixed issue with ossec_group field extraction when using ossec-alerts sourcetype.

  • Removed extra divider from Utilities nav menu

  • pyOSSEC cleanup and fixes:

    • Implemented support for disabling configuration stanzas
    • Normalized whitespace
Version 1.0.26
March 1, 2010

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.