Difference between revisions of "Monitoring a local file using OSSEC Integration"

From khika
Jump to navigation Jump to search
(Configure the OSSEC Agent to monitor the local file)
(Install an OSSEC Agent on the end node.)
Line 3: Line 3:
 
KHIKA integrates closely with OSSEC to monitor application logs in real time. This section explains how to use OSSEC to monitor the application logs. We begin with broad level steps and then dive deep into each step so that we explain the methodology and the intricate details associated with it. At a broad level you perform following steps
 
KHIKA integrates closely with OSSEC to monitor application logs in real time. This section explains how to use OSSEC to monitor the application logs. We begin with broad level steps and then dive deep into each step so that we explain the methodology and the intricate details associated with it. At a broad level you perform following steps
 
===  Install an OSSEC Agent on the end node. ===
 
===  Install an OSSEC Agent on the end node. ===
Please refer the appropriate section sections on [[KHIKA_App_for_Linux#Installing_OSSEC_Agent_for_Linux|<span style="color:#0000ff"> Linux </span>]] or [[KHIKA_App_for_Windows#Installing_OSSEC_Agent_for_Windows|<span style="color:#0000ff"> Windows </span>]] for installing the OSSEC Agent.
+
OSSEC Agent provides the simplest way to monitor a local file on any computer in real time. You must install the OSSEC agent where the file is being created. Please refer the appropriate section sections on [[KHIKA_App_for_Linux#Installing_OSSEC_Agent_for_Linux|<span style="color:#0000ff"> Linux </span>]] or [[KHIKA_App_for_Windows#Installing_OSSEC_Agent_for_Windows|<span style="color:#0000ff"> Windows </span>]] for installing the OSSEC Agent.
  
 
===  Configure the OSSEC Agent to monitor the local file ===
 
===  Configure the OSSEC Agent to monitor the local file ===

Revision as of 11:22, 3 June 2019

In addition to event logs or syslogs, a lot of local files are created by various applications. These files reside on the hosts/servers where applications run and contain wealth of information, valuable for both security and operational intelligence. The application logs are useful for debugging or capturing run time errors/exception or even business opportunities in production production environments. It is imperative to monitor local files for gaining actionable insights, real time alerting, correlations and forensic debugging.

KHIKA integrates closely with OSSEC to monitor application logs in real time. This section explains how to use OSSEC to monitor the application logs. We begin with broad level steps and then dive deep into each step so that we explain the methodology and the intricate details associated with it. At a broad level you perform following steps

Install an OSSEC Agent on the end node.

OSSEC Agent provides the simplest way to monitor a local file on any computer in real time. You must install the OSSEC agent where the file is being created. Please refer the appropriate section sections on Linux or Windows for installing the OSSEC Agent.

Configure the OSSEC Agent to monitor the local file

Once the OSSEC agent is installed, you need to locate the file you want to monitor. In this example, we will monitor apache access logs created in the directory /path/of/apache/access/log and name of the file is access.log

  1. Login to OSSEC Agent node and open file ossec.conf. On Windows this file is located in C:\Program Files (x86)\ossec-agent directory . On Linux, you will find it at /vat/ossec/ossec-agent/etc directory. (if you have installed the agent in the default location)
  2. Locate section <localfile>. Note that ossec.conf uses XML formatting and hence you have to be careful enough not to disturb the other tags. Navigate just above "Rootcheck - Policy monitor config" tag and insert following section
 <localfile>
   <location>/path/of/apache/access/log/access.log</location>
   <log_format>syslog</log_format>
 </localfile>

Note that we have added <log_format>syslog<log_format> as the apache access logs are single line messages and OSSEC will treat them same as syslog messages.

We save the file and restart OSSEC Agent. This will start apache access logs being received at the OSSEC Server side (i.e. on Data Aggregator Node). Nothing is going in KHIKA as of now as we have not configured the adapter. We are still at OSSEC level.

Parse the file using extensible KHIKA Adapter for OSSEC

Set any enrichment rules (if any)

Set the index in Elastic Search

Define alerts and dashboards

Define alerts and correlations