In my present lab setup I have few windows machines and linux machines with ossec agent installed and sending logs to ossec server. From OSSEC server I am forwarding the logs via syslog output to logstash. In logstash I am not doing any modification, simply I am forwarding the plain log to qradar as received(I verified it). It have alert level, rule and event. But in qradar it's showing single log source that is the logstash server. From logstash I send the logs as syslog to qradar. Ideally, in qradar all machines which are sending logs to ossec should be listed in log sources, but it's not happening. What's I am doing wrong here? Any help.. I followed this link https://www.ibm.com/support/knowledgecenter/en/SS42VS_DSM/t_DSM_guide_OSSEC_cfg.html instead directly sending logs to qradar I placed a logstash in between.
OSSEC server or wazuh server to Logstash to Qradar pipeline
1k Views Asked by iamvishnuks At
1
There are 1 best solutions below
Related Questions in LOGSTASH
- UnresolvedAddressException in Logstash+elasticsearch
- Grok parse error when using custom pattern definitions
- Delete logs after consumption: logstash
- Delete records of a certain type from logstash/elasticsearch
- Unable to push data from file to elastic search
- logstash dns filter miss
- Logstash parse error CISCOTIMESTAMP Debugger checks OK
- Performing searches on JSON data in Elasticsearch
- Logstash not writing to Elasticsearch with Shield
- logstash parsing timestamp halfday am/pm
- Parsing multiline log file in Logstash
- how to start logstash-forwarder as a service in Windows?
- How to parse a xml-file with logstash filters
- Cannot select a pattern as defaultIndex on Kibana
- What is better: logStash agents on the appserver or the remote kibana server?
Related Questions in OSSEC
- Unable to install OSSEC - Error: pcre2.h: No such file or directory
- OSSEC adding allowed fields from decoders to rules description
- Unable to analyse MySQL error logs in OSSEC
- upgrading from ossec to wazuh - "local/standalone" mode?
- Local database file for wazuh
- OSSEC HIDS on AWS ECS
- How to automate registering the OSSEC agent ip address on manager server?
- Not showing OSSEC agent actual IP address on manager server
- ossec-slack active-response on ossec agent
- gpg: no valid OpenPGP data found while adding Wazuh repository
- WAZUH All Commands monitor
- Intrusion Detection System OSSEC
- OSSEC email notification failed to send an email
- Where to put which OSSEC configuration - monitoring crontab
- OSSEC Agent -- Capturing hourly logs
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
I do not see anything wrong, if you have a Logstash between your devices and QRadar then the only log source that QRadar knows about is your Logstash server, it is the only service sending data to it.
If you want to see your ossec devices listed as log sources in QRadar I think that you will need to ship the logs directly to QRadar.
edit: I do not know QRadar very well, but if it is possible to use tags or custom fields to identifier a log source, maybe you can add a custom field in your logstash pipeline and QRadar will use this field to know that the log source is not your logstash server, but other device.