hello everyone some have experience with osquery integration

Question

hello everyone some have experience with osquery integration towards alienvault ossim opensource no USM

stefanmaerz · Answer

you might have more responses if you describe what you ve done what you need

stefanmaerz · Answer

I have not used ossim However I did get data into Splunk using the Splunk forwarder in conjunction with Fleet

sebasveloso · Answer

thanks for you response < stefanmaerz>

sebasveloso · Answer

I basically need to establish a transition from OSSEC to osquery but ossim by default does not have a plugin

sebasveloso · Answer

only USM paid version Alienvault

sebasveloso · Answer

any ideas < stefanmaerz>

sebasveloso · Answer

hehe

stefanmaerz · Answer

Well I know nothing about the ossim plugin presumably it provides some means of ingesting a log file So i suppose you could either use that functionality on each osquery endpoint or aggregate the logs in a central place via syslog or fleet then use that functionaly to ingest the log file

stefanmaerz · Answer

The other issue you might encounter is if the ossim plugin does any magic like text parsing or correlation or whatever Osquery outputs JSON which should be easy for a SIEM to parse

sebasveloso · Answer

thanks bro < stefanmaerz>

sebasveloso · Answer

sebasveloso · Answer

algo asi puede servir smiley