search

dsvetlov / lightsiem

Lightweight and sexy Security Information and Event Managment system for OSSEC, Snort and other IDS/IPS
107 stars 35 forks source link

Modify OSSEC_HYBRID_SERVER_HOST settings in ossec.pattern #21

Open craiglawson opened 9 years ago

craiglawson commented 9 years ago

Instead of Alert.Analyzer.Analyzer.Node.Name, which can be confusing to read at a glance, would it be suitable to highlight that this is a log which has arrived via hybrid box e.g. Alert.Analyzer.Hybrid.Node.Name?

And repeat for the other patterns...

dsvetlov commented 9 years ago

Hi, Craig!

I'm endeavor to use IDMEF format for alert formatting. It have RFC and very comprehencive. IDMEF format assumes that analyzers can be chained. And OSSEC assumes that too. As I can understand you can create very long structure of hybrid OSSEC servers. So, in most common case you need to make name for every analyzer in chain. I think it is not bad idea.

What problem, you are trying to solve? May be it'll be better to make some kind of composite name of analyzers path? Something like Alert.Analyzing.Path:OSSECserver<-OSSEChybrid<-OSSECagent.

craiglawson commented 9 years ago

Ahh, that makes sense, I will need to have a read of that RFC (https://www.ietf.org/rfc/rfc4765.txt ?)... Queue up the coffee!

I guess the "problem" I was trying to solve was to make the fields a little clearer, yes, it's not something you would really need to edit on a regular basis, I just found myself having to double check which field I was working with more often.

dsvetlov commented 9 years ago

@craiglawson, I think we can add a config for logstash. It config will make custom transforms for users. That way all configs will be consistent with master branch, but end user still can modify or add fields. One problem, is that kibana can't automatically reflect that changes and user must create custom dashboards for using custom fields.

What do you think about it?