This package contains parsing logic, saved searches, and dashboards for monitoring the OSSEC Host-based Intrusion Detection System via Splunk.
Please read the Installation section below - the app will not work correctly without configuration.
Some functionality, primarily agent management, is not currently supported when Splunk is running on Windows.
To install, extract the .tgz archive in $SPLUNK_HOME/etc/apps
You may need to enable the appropriate inputs, either via inputs.conf, or through the Manager in the Splunk GUI.
The application maintains a list of all known OSSEC servers in a lookup table. When you first install, this list will be empty except for a wildcard ntry. You can wait until it is populated automatically, or run OSSEC - Rebuild OSSEC Server Lookup Table from the Searches & Reports -> Utility menu.
This version introduces a number of changes, particularly from version 1.0 (see the CHANGES file). The recommended procedure is to remove the old app before installing. Installing over top of older versions should (mostly) work, but may cause some problems.
Sample input declarations are included with the application, but are disabled by default. These may be enabled either in inputs.conf, or via the Manager.
Several data input methods are available:
For options (1) and (2), set the sourcetype to 'ossec'.
For option (3), set the sourcetype to 'ossec_alerts'.
For option (4), set the sourcetype to 'ossec_agent_control'.
To collect OSSEC agent status, you will need to be able run the agent_control command without a password.
For local OSSEC servers using the default path, this is configured by default. For non-standard install paths, you will need to edit ossec_servers.conf.
For remote execution, see below.
To enable key management, you will need to be able to run the manage_agents command without a password. You will also need to be a member of either the Splunk Admin role or the OSSEC Admin role.
This feature is not enabled by default for security reasons. You can enable it by editing ossec_servers.conf.
For remote execution, see below.
For remote agent status collection and remote management, you can use SSH and sudo to avoid password prompts.
The Splunk service account (root by default) will need to be able to log into the OSSEC server as a user with permissions to run the following commands without being prompted for a password:
agent_control -l
manage_agents
For more detailed instructions, consult Splunk Answers:
http://splunk-base.splunk.com/answers/42717/how-do-i-enable-remote-agent-management-in-splunk-for-ossec
At present, the agent coverage dashboard currently relies on agent status information from the agent_control command (see above). A Splunk Enterprise license is needed for the scheduled searches.
To use agent coverage tracking, you must populate a lookup table that tracks all hosts that should be monitored by OSSEC. By default, all hosts seen by Splunk in the last 30 days will be expected.
Edit the saved search OSSEC - Track Expected Hosts to configure your own list. For example, all servers or all members of a particular LDAP container.
Alerting on malware file hashes only works when Splunk is directly monitoring the ossec alerts log (Syslog-based logging does not include the hashes).
If you are using this method, you can configure your email address and enable the alert from the Manager.
The MD5 and SHA1 file hashes will be sent to a third party (Team Cymru) for validation.
No guarantees of accuracy are provided.
This app includes third-party components and/or interfaces with third-party services. See the 3rdparty directory for details.
OSSEC is a product of Daniel Cid and Trend Micro. The app author is not afilliated with Trend Micro.
Splunk for OSSEC neither supported nor endorsed by Trend Micro or the OSSEC developers. The author makes no warranties or
guarantees of any kind. Use is at your own risk.
Fixed a bug in ossec_agent_status that could prevent agent status polling from working correctly in certain configurations.
Increased timeout on agent status polling from 5 to 30 seconds
Updated rule group lookup table with rules from latest OSSEC build on BitBucket.
Removed unused Intersplunk dependency from pyOSSEC to ease command-line testing.
Added indexing of ossec.log file when Splunk is installed on the
OSSEC server.
Added saved search to re-initialize ossec server lookup table
Bugfixes / parsing improvements when working with local alerts file
(when Splunk is installed directly on the OSSEC server)
Improved suppression of Windows event explanatory text when working
with local alerts file (Splunk installed directly on OSSEC server)
Re-scoped Navigation menu to avoid clobbering menus in other app
views.
Updated rule group lookup table with rules from OSSEC 2.6 beta
Modified rule group lookup generating script to accept rules directory
as a parameter
Added indexing of Active Response logs when Splunk is installed on the
OSSEC server
Fixed an issue in the Agent Management view that could cause the
list of managed servers to appear empty.
Removed local.meta file that had accidentally slipped into the
distribution.
Corrected CSS formatting in Agent Coverage view.
Corrected stats calculation for Top 10 views
Added triggers entry in app.conf
Resolved a display error affecting File Integrity view with Splunk 4.2
Added workflow action for VirusTotal hash lookups
Minor bugfixes
Stripped out explanatory text on Microsoft-Windows-Security-Auditing events
("This event is generated when...")
Extracted EventCode, LogName, SourceName, and Type for Windows events
Added Event Renderer for high-severity events (modify the eventtype to tune threshold)
Better handling of agent management connection errors
Increased default timeouts on agent connection
Updated rule group lookup table to match OSSEC 2.5 ruleset
Increased results shown on agent management dashboard from 10 to 15
Modified Event Search view to better handle events with no ossec_group.
Fixed issue with ossec_group field extraction when using ossec-alerts sourcetype.
Removed extra divider from Utilities nav menu
pyOSSEC cleanup and fixes:
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.