hello everyone, some have experience with osquery ...
# generals
sebasveloso
09/24/2018, 3:33 PMhello everyone, some have experience with osquery integration towards alienvault ossim (opensource, no-USM)
?
s
stefanmaerz
09/24/2018, 3:55 PMyou might have more responses if you describe what you've done/what you need.
stefanmaerz
09/24/2018, 3:55 PMI have not used ossim. However I did get data into Splunk using the Splunk forwarder in conjunction with Fleet.
s
sebasveloso
09/24/2018, 5:45 PMthanks for you response @stefanmaerz
sebasveloso
09/24/2018, 5:48 PMI basically need to establish a transition from OSSEC to osquery. but ossim by default does not have a plugin
sebasveloso
09/24/2018, 5:49 PMonly USM (paid version) Alienvault ..
sebasveloso
09/24/2018, 8:20 PMany ideas? @stefanmaerz
sebasveloso
09/24/2018, 8:20 PMhehe
s
stefanmaerz
09/25/2018, 12:40 PMWell. I know nothing about the ossim plugin. presumably it provides some means of ingesting a log file.
So i suppose you could either: use that functionality on each osquery endpoint or aggregate the logs in a central place via syslog or fleet, then use that functionaly to ingest the log file.
stefanmaerz
09/25/2018, 12:47 PMThe other issue you might encounter is if the ossim plugin does any magic like text parsing or correlation or whatever. Osquery outputs JSON, which should be easy for a SIEM to parse
👍 1
s
sebasveloso
09/25/2018, 1:08 PMthanks bro! @stefanmaerz
sebasveloso
09/25/2018, 1:09 PMalgo asi puede servir 😃
6 Views