SIEM is not displaying my alert

56 views

Skip to first unread message

Diego S

unread,

Oct 21, 2019, 10:05:32 AM10/21/19

to ossec...@googlegroups.com

Hi everyone!

Im not getting the alerts generated on the server reflected on SIEM dashboard.

I followed this steps to take data from logs of an agent.
https://www.alienvault.com/documentation/usm-appliance/ids-configuration/process-reading-log-file-with-hids-agent-windows.htm

Im getting the alert on alerts.log but im not able to find it on SIEM dashboard.

I dont know if this is a policy or event correlation thing. But im not clear what is the process from reciving an alert to getting reflected on SIEM.

Thanks and regards!

Diego.

José Manuel López del Río

unread,

Oct 1, 2020, 11:49:57 AM10/1/20

to ossec-list

Hello Diego,

Could you verify that the SIEM dashboard is displaying other types of alerts? In case it is not, it might be related to the way it is sending the alerts to the interface.

Also, make sure that your interface ingestion is taking the information from the alerts.log file. I would recommend making sure that the file used for the Dashboard ingestion is enabled.