search

philhagen / sof-elk

Configuration files for the SOF-ELK VM
GNU General Public License v3.0
1.47k stars 276 forks source link

Feature request: Integrate Velociraptor via Logstash plugins #250

Open certrik opened 2 years ago

certrik commented 2 years ago

Following https://velociraptor.velocidex.com/velociraptor-to-elasticsearch-3a9fc02c6568 it should be quite feasible to integrate Velociraptor flows into SOF-ELK using logstash-input-http and logstash-codec-es_bulk . Would be really great to have the possibility to also use Velociraptor with SOF-ELK.

certrik commented 2 years ago

@philhagen Is this something that could make it to SOF-ELK or is this completely out of the picture?

DfirJos commented 2 years ago

You can integrate it via this way: https://velociraptor.velocidex.com/velociraptor-to-elasticsearch-3a9fc02c6568