{"id":6540,"date":"2013-05-13T07:00:04","date_gmt":"2013-05-13T05:00:04","guid":{"rendered":"http:\/\/nolabnoparty.com\/?p=6540"},"modified":"2020-03-15T17:35:32","modified_gmt":"2020-03-15T16:35:32","slug":"setup-ossec-with-splunk","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/setup-ossec-with-splunk\/","title":{"rendered":"Setup OSSEC with Splunk"},"content":{"rendered":"

\"ossecsplunk01\"<\/p>\n

Installing OSSEC with Splunk allows a better overview<\/strong> of the thousand information collected by the system useful to create reports<\/strong> for the management.<\/p>\n

Splunk is the tools that can be integrated into OSSEC to transform the logs in a graphic format<\/strong> with some built-in reports that allows to better check monitored systems.<\/p>\n

<\/p>\n

Configure OSSEC<\/span><\/h2>\n

OSSEC installation procedure can be found in this post<\/a>.<\/p>\n

To enable syslog, edit OSSEC configuration file ossec.conf<\/em> and add the following lines:<\/p>\n

<syslog_output>\r\n   <server>192.168.10.109<\/server>        # OSSEC server IP\r\n   <port>10002<\/port>\r\n<\/syslog_output><\/pre>\n
# vi \/var\/ossec\/etc\/ossec.conf<\/span><\/p>\n
\"ossecsplunk02\"<\/p>\n
Enable module syslog_output<\/strong> and restart OSSEC.<\/p>\n
# \/var\/ossec\/bin\/ossec-control enable client-syslog
\n# \/var\/ossec\/bin\/ossec-control restart<\/span><\/p>\n
\"ossecsplunk03\"<\/p>\n
 <\/p>\n
Install Splunk<\/span><\/h2>\n
Download from website<\/a> latest Splunk release and install the application through rpm command.<\/p>\n
# rpm -Uvh splunk-5.0.2-149561-linux-2.6-x86_64.rpm<\/span><\/p>\n
\"ossecsplunk04\"<\/p>\n
Edit the configuration file inputs.conf<\/em> and add this stanza<\/strong>:<\/p>\n
[udp:\/\/192.168.10.109:10002]             # OSSEC server IP\r\ndisabled = false\r\nsourcetype = ossec<\/pre>\n
# vi \/opt\/splunk\/etc\/system\/default\/inputs.conf<\/span><\/p>\n
\"ossecsplunk05\"<\/p>\n
Restart Splunk. If this is the first time application starts, you need to accept the EULA<\/strong>.<\/p>\n
# \/opt\/splunk\/bin\/splunk restart<\/span><\/p>\n
\"ossecsplunk06\"<\/p>\n
Type on your browser http:\/\/OSSEC_IP:8000<\/span><\/strong> and login to Splunk using default credential admin\/changeme<\/strong>. At first logon, you are prompted to change the password. If the firewall is turned on, add exception\u00a0TCP:8000<\/strong>.<\/p>\n
\"ossecsplunk07\"<\/p>\n
Splunk main screen.<\/p>\n
\"ossecsplunk08\"<\/p>\n
 <\/p>\n
Install Splunk for OSSEC<\/span><\/h2>\n
Download Splunk for OSSEC application<\/a> and from Splunk main window click on menu App > Manage apps<\/strong>.<\/p>\n
\"ossecsplunk09\"<\/p>\n
Click on Install app from file<\/strong> button.<\/p>\n
\"ossecsplunk10\"<\/p>\n
Click on Choose File<\/strong> button and select the downloaded file ossec-1.1.89.tgz<\/strong>. Click Upload<\/strong> to load the application into Splunk.<\/p>\n
\"ossecsplunk11\"<\/p>\n
When the application has been uploaded, system needs to be restarted. Click Restart Splunk<\/strong> to continue.<\/p>\n
\"ossecsplunk12\"<\/p>\n
System is then restarted<\/strong>.<\/p>\n
\"ossecsplunk13\"<\/p>\n
Once logged in again into system, you get the notification of installed app<\/strong>.<\/p>\n
\"ossecsplunk14\"<\/p>\n
Clicking Apps<\/strong> on main screen, a list with all installed apps appears. Identify the line Splunk for OSSEC <\/strong>and click Launch app<\/strong> under Actions<\/strong>.<\/p>\n
\"ossecsplunk15\"<\/p>\n
Splunk for OSSEC main screen opens.<\/p>\n
\"ossecsplunk16\"<\/p>\n
Click Dashboards & Views<\/strong> menu and select OSSEC Dashboard<\/strong> option.<\/p>\n
\"ossecsplunk17\"<\/p>\n
Collected data are displayed in graphic format<\/strong> easy to be read at first sight.<\/p>\n
\"ossecsplunk18\"<\/p>\n
Splunk is a powerful tool to display collected data and reports can be easily created selecting available templates under Searches & Reports<\/strong> menu.<\/p>\n
 <\/p>\n
Remove data from indexes<\/h2>\n
To delete indexed data permanently from your disk, from the console run the the following commands:<\/p>\n
# service splunk stop<\/span>
\n# \/opt\/splunk\/bin<\/span>
\n# .\/splunk clean eventdata<\/span>
\n# service splunk start\u00a0<\/span><\/p>\n
This command completely deletes<\/strong> the data in all indexes releasing unused disk space.<\/p>\n
\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
Installing OSSEC with Splunk allows a better overview of the thousand information collected by the system useful to create reports for the management. Splunk is the tools that can be integrated into OSSEC to transform the logs in a graphic format with some built-in reports that allows to better check monitored systems.<\/p>\n","protected":false},"author":3,"featured_media":6522,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"facebook_2879994398731222_17841400390232720":"","mastodon_115463926174894442_115463926174894442":"","linkedin_93tdZWzMZc_93tdZWzMZc":"","bluesky_did:plc:tkabz5kl2rukzdwtuongv3kz_did:plc:tkabz5kl2rukzdwtuongv3kz":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[899,898],"tags":[639,634,589,594,645],"class_list":["post-6540","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-analysis-en","category-monitoring-en","tag-data-analysis","tag-monitoring-en","tag-ossec-en","tag-splunk-en","tag-syslog-en","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/6540","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=6540"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/6540\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/6522"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=6540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=6540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=6540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}