Integration with MS SCCM

[Irshad Rahimbux]

Dear Team,

I would like to integrate Microsoft SCCM with OSSIM.

All configuration has been done in ms-sccm.cfg [which was already available].

Logs are coming to /var/log/alienvault/agent.log but not to /var/ossec/logs/alerts/alerts.log

Any idea why and what I am doing wrong?

kindly advise.

Rgds.

[dan (ddp)]

In SCCM's configuration file, how are you sending the logs to OSSEC?

> kindly advise.
>
> Rgds.
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Irshad Rahimbux]

I have did all the configuration in ms-sccm.cfg [existing file in plugin folder].

But still dont see anything in alerts.log.

[dan (ddp)]

On Fri, Jul 7, 2017 at 8:10 AM, Irshad Rahimbux
<irshadra...@gmail.com> wrote:
> I have did all the configuration in ms-sccm.cfg [existing file in plugin
> folder].
>

That must be an OSSIM thing. Unrelated to OSSEC.

> But still dont see anything in alerts.log.
>

Turn on the logall option, restart the OSSEC processes on the server.
Then look through the archives.log for log samples from SCCM