Thanks For Downloading!

Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows:

Windows: Decompress the downloaded file using a tool like 7-Zip and place the resulting folder into %PROGRAMFILES%\Splunk\etc\apps. Then restart Splunk using the splunk restart command or the GUI.

Unix/Linux: Decompress the downloaded file using a tool like tar -xvf and place the resulting folder into $SPLUNK_HOME/etc/apps. Then restart Splunk using the splunk restart command or the GUI.

This package contains parsing logic, saved searches, and dashboards for monitoring the OSSEC Host-based Intrusion Detection System via Splunk. Support for managing agent keys via is also provided.

Please read the Installation section - the app WILL NOT WORK without configuration.

Overview

This package contains parsing logic, saved searches, and dashboards for monitoring the OSSEC Host-based Intrusion Detection System via Splunk.

Please read the Installation section below - the app will not work correctly without configuration.

Some functionality, primarily agent management, is not currently supported when Splunk is running on Windows.

Installation

To install, extract the .tgz archive in $SPLUNK_HOME/etc/apps

You may need to enable the appropriate inputs, either via inputs.conf, or through the Manager in the Splunk GUI.

The application maintains a list of all known OSSEC servers in a lookup table. When you first install, this list will be empty except for a wildcard ntry. You can wait until it is populated automatically, or run OSSEC - Rebuild OSSEC Server Lookup Table from the Searches & Reports -> Utility menu.

Upgrading

This version introduces a number of changes, particularly from version 1.0 (see the CHANGES file). The recommended procedure is to remove the old app before installing. Installing over top of older versions should (mostly) work, but may cause some problems.

Data Inputs

Sample input declarations are included with the application, but are disabled by default. These may be enabled either in inputs.conf, or via the Manager.

Several data input methods are available:

1. Native syslog daemon, writing to flat files which are indexed by Splunk.
2. Syslog-style input directly to Splunk
3. Direct monitoring of OSSEC alert logs. Typically requires Splunk to be installed on the OSSEC server.
4. Scripted input to periodically check the status of OSSEC agents by running ossec_agent_control -l, either locally or on a remote system.

For options (1) and (2), set the sourcetype to 'ossec'.
For option (3), set the sourcetype to 'ossec_alerts'.
For option (4), set the sourcetype to 'ossec_agent_control'.

Collection of OSSEC agent Operational Status:

To collect OSSEC agent status, you will need to be able run the agent_control command without a password.

For local OSSEC servers using the default path, this is configured by default. For non-standard install paths, you will need to edit ossec_servers.conf.

For remote execution, see below.

Managing Agent Keys from Splunk

To enable key management, you will need to be able to run the manage_agents command without a password. You will also need to be a member of either the Splunk Admin role or the OSSEC Admin role.

This feature is not enabled by default for security reasons. You can enable it by editing ossec_servers.conf.

For remote execution, see below.

Enabling Remote Execution

For remote agent status collection and remote management, you can use SSH and sudo to avoid password prompts.

The Splunk service account (root by default) will need to be able to log into the OSSEC server as a user with permissions to run the following commands without being prompted for a password:
agent_control -l
manage_agents

For more detailed instructions, consult Splunk Answers:
<http://splunk-base.splunk.com/answers/42717/how-do-i-enable-remote-agent-management-in-splunk-for-ossec>

Agent Coverage Tracking

At present, the agent coverage dashboard currently relies on agent status information from the agent_control command (see above). A Splunk Enterprise license is needed for the scheduled searches.

To use agent coverage tracking, you must populate a lookup table that tracks all hosts that should be monitored by OSSEC. By default, all hosts seen by Splunk in the last 30 days will be expected.

Edit the saved search OSSEC - Track Expected Hosts to configure your own list. For example, all servers or all members of a particular LDAP container.

Malware Alerting

Alerting on malware file hashes only works when Splunk is directly monitoring the ossec alerts log (Syslog-based logging does not include the hashes).

If you are using this method, you can configure your email address and enable the alert from the Manager.

The MD5 and SHA1 file hashes will be sent to a third party (Team Cymru) for validation.

No guarantees of accuracy are provided.

3rd-Party Components / Disclaimers

This app includes third-party components and/or interfaces with third-party services. See the 3rdparty directory for details.

OSSEC is a product of Daniel Cid and Trend Micro. The app author is not afilliated with Trend Micro.

Splunk for OSSEC neither supported nor endorsed by Trend Micro or the OSSEC developers. The author makes no warranties or
guarantees of any kind. Use is at your own risk.