sof-elk icon indicating copy to clipboard operation
sof-elk copied to clipboard

Published 20 hours ago • verified publisher icon philhagen

Feature request: Integrate Velociraptor via Logstash plugins

Open certrik opened this issue 2 years ago • 2 comments

Following https://velociraptor.velocidex.com/velociraptor-to-elasticsearch-3a9fc02c6568 it should be quite feasible to integrate Velociraptor flows into SOF-ELK using logstash-input-http and logstash-codec-es_bulk . Would be really great to have the possibility to also use Velociraptor with SOF-ELK.

certrik avatar Mar 30 '22 21:03 certrik

@philhagen Is this something that could make it to SOF-ELK or is this completely out of the picture?

certrik avatar Apr 15 '22 08:04 certrik

You can integrate it via this way: https://velociraptor.velocidex.com/velociraptor-to-elasticsearch-3a9fc02c6568

DfirJos avatar Aug 31 '22 11:08 DfirJos