" I send alert level ossec via syslog to rsyslog ossim but not working because OSSIM use custom log with tag AV in front of each log so alert from ossec server not recognize by OSSIM "
OSSIM has plugins built to read that default output, you don't need to route OSSEC syslog to OSSIM, you merely need to have the OSSEC agent report to the OSSEC server running "on" the OSSIM platform and have the correct plugins enabled. Does this help? On Wednesday, November 12, 2014 9:09:36 AM UTC-5, dan (ddpbsd) wrote: > > On Wed, Nov 12, 2014 at 5:47 AM, Teddy Jayasaputra > <teddy.ja...@gmail.com <javascript:>> wrote: > > Dear all, > > > > Any of you have working with ossec server talking to ossec in OSSIM? > > > > I send alert level ossec via syslog to rsyslog ossim but not working > because > > OSSIM use custom log with tag AV in front of each log so alert from > ossec > > server not recognize by OSSIM. > > > > I heard about ossec in hybrid mode. > > Can someone describe it? Or point me the manual to do it? Can hybrid > mode > > solve deployment ossec to ossec in OSSIM ? > > > > Hybrid mode allows an OSSEC manager to report alerts to another OSSEC > manager. > > > Thanks. > > > > Best Regards, > > > > -Teddy- > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to ossec-list+...@googlegroups.com <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
