syslog

[birka1]

hi is there away to send the threat logs also to syslog (SIEM)?

[stamparm]

Currently not, but I would like to know the syslog format you (or other users) would like to support?

[xECK29x]

CEF (Common Event Format) would be best. It is one of the more common standards and is supported by almost all SIEMs or log aggregation tools including Splunk, ArcSight, LogRhythm and IBM QRadar.

http://www.iwebdev.it/blog/?tag=common-event-format https://www.protect724.hpe.com/docs/DOC-1072

[birka1]

agree with xECK29x

by the way there is newletter or something like that ? how we inform about new version or new features?

[jjjan]

we appreciate to have it as splunk app

[stamparm]

@xECK29x so, something like this would suffice?

Mar 16 16:43:10 sensor1 CEF:0|maltrail|sensor|0.10.115|2016-05-10|known attacker|10|src=10.0.0.192 spt=1234 dst=12.121.122.82 dpt=4123 proto=TCP

[xECK29x]

@stamparm That looks great!

[jjjan]

that's great with nice dashboard

[stamparm]

Basic implementation is done. Now you'll find inside the maltrail.conf the following NEW option:

# Remote address to send syslog entries
#SYSLOG_SERVER 192.168.2.107:514

Just uncomment it (SYSLOG_SERVER) and write your own SYSLOG server address:port.

Current known limitations is that Severity is put to 0 as the column severity inside the Maltrail's web client is calculating it inside (JS logic). If there will be a need to transfer that same "logic" I'll do it here too.

Also, I am not sure whether trail and reference columns are also needed inside the SYSLOG message.

[xECK29x]

This looks great! I would say it's safe to over-log items and include the trail and reference fields and let the user decide what to strip out or create extracted fields for in their system of use. Can't wait to use this with Splunk!

[stamparm]

@xECK29x with the latest revision both trail and reference are included too

[xECK29x]

Fantastic!

[birka1]

Great! works like a charm thanks

[dpicollege]

first of all thanks for useful project. after so long time we need structure log like the user @jjjan said or make splunk app. we need all output like severity. good luck

[dbinoj]

stamparm, If you are implementing severity for syslog messages, please send that data via LOG_SERVER option too. If needed, it can be made configurable. Our SIEM is happy with the RAW log format as it is just CSV with space as delimiter and double quotes to include fields with spaces. Also this format requires less space as column names are fixed and not transported with each message.

[netsysadm]

Hi i tried commention the SYSLOG in maltrail conf and allow the port both on the maltrail server going to the syslog server(graylog) tried both CEF UDP and SYSLOG UDP but logserver still not able to receive anything, the port on the maltrail isnt even listening. Can anyone help please? Do i need to install rsyslog for this purpose?