Alert for Audit Process Failure

[rampart51]

Is there a canned alert for that can be triggered in the event of an audit process failure? I have checked the Playbook but have not found what anything to that effect. Any help and/or guidance is appreciated. I also have not found a similar thread.

[defensivedepth]

Some additional info would be helpful - specifically what logs you are targeting for an alert. Do you have specific Event IDs etc? (Assuming this is for Windows)

[rampart51]

Unfortunately it is a very general requirement... Alert in the event of an audit process failure. I take that to mean a "low water mark" of sorts. If no events are received from a source or any source... trigger an alert.

[defensivedepth]

Oh ok, so this requirement is specifically talking about your Security Onion instance?

There are different ways that you could handle this. Granafa monitors a number of potential issues for the Grid itself - For example - Zeek packet & capture loss. https://docs.securityonion.net/en/2.3/zeek.html?#packet-loss-and-capture-loss

You can also configure Grafana to generate alerts if certain conditions are met ie low disk space or high capture loss etc.

We have a free video on YouTube that talks through this: Setting up alarms for operational issues in Security Onion - https://www.youtube.com/watch?v=8FmZ4MRe8Uk&feature=youtu.be

[rampart51]

Yes, for the SO instance specifically. Thank you for the links. I will go through them and see what I can get set up.