KSC (Kaspersky) logs to Wazuh

[Nemo191 Nm]

Hello. Please tell me how to connect receiving logs from KSC (Kaspersky) to Wazuh?

[Nemo191 Nm]

In the web console, KSC has configured the export of logs to Wazup (the IP address of the Wsus server and port 514).
How to get logs in a non-reactive way, decode and configure rules.
And how do I check that the Wazzup server receives logs from KSC?

пятница, 29 марта 2024 г. в 12:11:55 UTC+3, Nemo191 Nm:

[Selu López]

Hello Nemo191 Nm,

In addition to what you have already done in KSC, you will also have to perform some steps in Wazuh so that it generates alerts from Kaspersky events. I attach the documentation below:

1. Configure syslog on the Wazuh server.
2. Temporarily enable the logall_json option in your ossec.conf and restart it. Doing this, Wazuh will store all the received events in the /var/ossec/logs/archives/archives.json file, regardless of whether they triggered an alert.
3. For these events to generate alerts that can be seen in the Wazuh dashboard, you will have to create custom rules (maybe also decoders). You can find a guide on how to do it in this blog post: Creating decoders and rules from scratch.

I hope you find this helpful. Let me know if you need anything else.

​

[Nemo191 Nm]

Hi! Thank you!

понедельник, 1 апреля 2024 г. в 12:29:39 UTC+3, Selu López: