{"id":90,"date":"2014-09-24T10:18:57","date_gmt":"2014-09-24T08:18:57","guid":{"rendered":"http:\/\/www.underealm.com\/tech\/?p=90"},"modified":"2014-09-24T10:18:57","modified_gmt":"2014-09-24T08:18:57","slug":"better-ossec-syslog-parsing-for-splunk","status":"publish","type":"post","link":"http:\/\/www.underealm.com\/tech\/2014\/09\/better-ossec-syslog-parsing-for-splunk\/","title":{"rendered":"Better OSSEC syslog parsing for Splunk"},"content":{"rendered":"<p>Just as predicted by the documentation, the syslog parsing of the OSSEC app for Splunk was a bit meh: while it would work in several instances it would terribly fail in others, like HTTP access for example. Below you can find the current version I&#8217;m using, which also provide additional fields that can be used for reports.<\/p>\n<pre class=\"start-line:134 lang:ini# toolbar:1\" title=\"\/opt\/splunk\/etc\/apps\/ossec\/default\/transforms.conf\" ><code>[ossec-syslog-message]\r\n#REGEX = ossec:.*?(Location:.*;)\\s*(user: [^;]+;\\s*)?(\\w{3} \\d+ [\\d:]+ \\w+ )?(.*)$\r\n#FORMAT = message::$4\r\nREGEX = ossec:.*?(Location: (.*?);)\\s*(srcip: ([a-f0-9:\\.]+);\\s*)?(user: [^;]+;\\s*)?([a-f0-9:\\.]+ ([a-zA-Z\\-]+ [a-zA-Z\\-]+) )?(\\[\\w{3} \\w{3} \\d+ \\d+:\\d+:\\d+\\.\\d+ \\d+\\]\\s*|\\w{3}$\r\nFORMAT = ossec_location::$2 ossec_srcip::$4 ossec_httpusergroup::$7 ossec_msgtimestamp::$8 message::$9<\/code><\/pre>\n<p>What you see commented out are the original instructions that can be safely removed. The new <abbr title=\"Regular Expression\">REGEX<\/abbr> is more complex than the original, maybe too much, but through this I can extract more information that were previously hidden, or not easily accessible, and at the same time remove redundant timestamps while having all the important messages correctly extracted.<\/p>\n<p>If you have suggestions, feel free to comment below.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Just as predicted by the documentation, the syslog parsing of the OSSEC app for Splunk was a bit meh: while it would work in several instances it would terribly fail in others, like HTTP access for example. Below you can find the current version I&#8217;m using, which also provide additional fields that can be used [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[61],"tags":[60,20,18,58],"class_list":["post-90","post","type-post","status-publish","format-standard","hentry","category-splunk","tag-ossec","tag-regex","tag-splunk","tag-sysad"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/www.underealm.com\/tech\/wp-json\/wp\/v2\/posts\/90"}],"collection":[{"href":"http:\/\/www.underealm.com\/tech\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.underealm.com\/tech\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.underealm.com\/tech\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.underealm.com\/tech\/wp-json\/wp\/v2\/comments?post=90"}],"version-history":[{"count":0,"href":"http:\/\/www.underealm.com\/tech\/wp-json\/wp\/v2\/posts\/90\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.underealm.com\/tech\/wp-json\/wp\/v2\/media?parent=90"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.underealm.com\/tech\/wp-json\/wp\/v2\/categories?post=90"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.underealm.com\/tech\/wp-json\/wp\/v2\/tags?post=90"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}