Kaspersky integration

[asrachid]

Hello! I want to integrate kaspersky to security onion.
My case : KSC version is 14.2, SO version is 2.4
I use a distributed architecture: a manager, a fleet node, a search node and a forward node.

[cm-ops]

Have you looked at this? https://support.kaspersky.com/datafeeds/integration/15474

[cm-ops]

You can certainly send them via syslog https://docs.securityonion.net/en/2.4/syslog.html#syslog, they will be parsed as syslog though. If you wanted them parsed out differently you would need to create a custom parser for the logs.

[asrachid]

I create a custom parser and I put it in "/opt/so/saltstack/local/salt/elasticsearch/files/ingest/", now I want to know where I should specify which logs should be parsed using this custom parser.

[cm-ops]

You would also need to create a custom Logstash pipeline to bring the logs in and send to Elasticsearch for parse (with your custom parser) and ingest.

If you are able to put an Elastic Agent on the server, you could set up a custom log integration policy.

[asrachid]

Logstash will just forward the logs to elasticsearch, but where in elasticsearch should I specify which parser to use for the particular logs we are sending.

[cm-ops]

In your Logstash output to Elasticsearch, you would specify the pipeline to send it to. https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-pipeline