blueteamvillage / DC31-obsidian-sec-eng

MIT License

1 stars 0 forks source link

Configure velociraptor forensics remote logging #147 #148

Closed juju4 closed 1 year ago

juju4 commented 1 year ago

Background

Configure velociraptor forensics remote logging +some KC change sync

Work in progress

Type of change

[x] New feature (non-breaking change which adds functionality)

Changes

terraform cribl ingress extended to tcp/9200-9210
cribl: sync KC setup, add input, route and output for velociraptor
splunk: add hec input and index

Testing

Setup manually on live setup Test negative for velociraptor logs (locally or cribl/splunk), ok for network (curl -v http://172.16.22.10:9210/)