Syslog Dashboard enrichement

[sleepingbel]

hello,

Can there be created a list whith hostnames that are forwarding logs?

This is useful if you need to search a specific host's logs for a specific moment.

On this moment I am using syslog only for routers, switches and printers. I can not change the syslog output of these devices.
On the syslog dashbord, none of the sub-screens have data .

Regards
Bart

[weslambert]

I would assume the syslog is not being parsed as expected. Are you able to locate the data by searching within Discover? As far as the list of devices you mentioned, you can create your own custom dashboards in Kibana, using fields from the events.

[sleepingbel]

Hello Wes,

I can see the data in discover. I will post some of them

the number between <> is the syslog priority
The first field is the timestamp
The second field is the hostname
And the rest is the message

And the log.source.address is recorded as IP address and port

When I look at the parser it normally parses the hostname, right?
I checked these two,

https://github.com/Security-Onion-Solutions/securityonion/blob/master/salt/elasticsearch/files/ingest/syslog
https://github.com/Security-Onion-Solutions/securityonion/blob/master/salt/elasticsearch/files/ingest/zeek.syslog

I'll be honest, I've never written a parser before, but I'm now looking for all the information about it, so I can start with it.

I have tried to create a grok for the syslog of the router

<%{INT:syslog.Priority}>%{SYSLOGTIMESTAMP:syslog.Timestamp} %{SYSLOGHOST:syslog.Host} %{SYSLOGPROG:syslog.Program} %{GREEDYDATA:syslog.Action} (%{GREEDYDATA:syslog.Src_IP} %{GREEDYDATA:syslog.Dst_IP} %{GREEDYDATA:syslog.Protocol})"

The result is not yet perfect, but i found the developers tools in the elastic features

{ "syslog": { "Action": "Drop ", "Program": "ACL", "Dst_IP": "Dst=2.17.198.9", "Src_IP": "Src=192.168.1.106", "Priority": "4", "Host": "RV130W", "Protocol": "Protocol=ICMP", "Timestamp": "Dec 8 19:06:41" }, "program": "ACL" }

I am now trying to remove the Src =, Dst = and Protocol = from the result. But no luck till now

Regards
Bart

[abesinger]

I don't know if it's of any help, but you might want to take a look at the ingest pipeline I posted in #5251