Skip to main content
Warning
This app is archived. App archiving documentation
Splunk Add-on for OSSEC app icon

Splunk Add-on for OSSEC

The Splunk Add-on for OSSEC allows a Splunk® software administrator to collect alert events from OSSEC servers over syslog. The add-on collects the following alert data from OSSEC:Built by Splunk LLC
splunk product badge
Default Version 4.1.0

November 3, 2020

Compatibility

Splunk Enterprise

Platform Version: 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0

CIM Version: 4.x

Rating
4
(6)

Log in to rate this app

Support
Archived Add-on

The Splunk Add-on for OSSEC allows a Splunk® software administrator to collect alert events from OSSEC servers over syslog. The add-on collects the following alert data from OSSEC: * File Integrity Management (FIM) data * FTP data * su data * ssh data * Windows data, including audit and logon information At this time, the add-on does not support data collection for OSSEC daemon logs, agent logs, or logs from the active response module.