In my present lab setup I have few windows machines and linux machines with ossec agent installed and sending logs to ossec server. From OSSEC server I am forwarding the logs via syslog output to logstash. In logstash I am not doing any modification, simply I am forwarding the plain log to qradar as received(I verified it). It have alert level, rule and event. But in qradar it's showing single log source that is the logstash server. From logstash I send the logs as syslog to qradar. Ideally, in qradar all machines which are sending logs to ossec should be listed in log sources, but it's not happening. What's I am doing wrong here? Any help.. I followed this link https://www.ibm.com/support/knowledgecenter/en/SS42VS_DSM/t_DSM_guide_OSSEC_cfg.html instead directly sending logs to qradar I placed a logstash in between.
OSSEC server or wazuh server to Logstash to Qradar pipeline
1k views Asked by iamvishnuks At
1
There are 1 answers
Related Questions in LOGSTASH
- use logstash filter ,aes gcm encrypted in ruby,but cannot decrypted in java
- Facing logstash compatibility issues
- Logback recording SpringBoot class member variable
- What is elasticsearch supported Logstash-output-jdbc plugin
- Kibana/Logstash not extracting data with grok pattern
- how to strip a variable using logback after a delimiter
- Docker compose - Logstash unable to connect to elastic search
- Not able to parse logs having spaces between key value pair in json
- Is there any way to remove log.syslog.structured_data field in logscale/kibana
- How to update logstash 8.9.1 to 8.12.02
- Issue with filebeat 8.12.2 output to logstash and then to elasticsearch with custom index name
- How to properly configure Logstash on windows
- Logstash - IOError Device or resource busy
- Logstash ERROR: (NameError) cannot initialize Java class org.logstash.plugins.AliasRegistry (java.lang.ExceptionInInitializerError)
- Syncing PostgreSQL with ElasticSearch
Related Questions in OSSEC
- ossec.conf on wazuh manager
- [Wazuh]Testing alternatives for encrypting messages
- Unable to install OSSEC - Error: pcre2.h: No such file or directory
- Wazuh windows agent cant connect after long disconnect
- Can fscanf buffer overflow when %d is used?
- wazuh, alert via email if no alert logged for 1 hour
- wazuh-logtest able to decode the mariadb log but no decoder in archive.json file for the same log
- Writing wazuh/ossec rules for windows eventchannel
- Local database file for wazuh
- Pushing OSSEC agent to 200 Windows servers
- gpg: no valid OpenPGP data found while adding Wazuh repository
- ossec-slack active-response on ossec agent
- Having difficulties to connect the OSSEC server with OSSEC agent using private instance in ubuntu 18.04
- Wazuh child decoder not parsing field correctly
- OSSEC Agent -- Capturing hourly logs
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
I do not see anything wrong, if you have a Logstash between your devices and QRadar then the only log source that QRadar knows about is your Logstash server, it is the only service sending data to it.
If you want to see your ossec devices listed as log sources in QRadar I think that you will need to ship the logs directly to QRadar.
edit: I do not know QRadar very well, but if it is possible to use tags or custom fields to identifier a log source, maybe you can add a custom field in your logstash pipeline and QRadar will use this field to know that the log source is not your logstash server, but other device.