ossec_agent: improvements from Brian Kellogg

[GoogleCodeExporter]

https://groups.google.com/d/topic/security-onion/QZ1aVC58LYo/discussion

Original issue reported on code.google.com by doug.bu...@gmail.com on 18 Mar 2015 at 1:41

[GoogleCodeExporter]

I've been running it in production for about a week with no issues thus far.  
Getting logs correctly into Sguil from OSSEC agents and syslog.

If OSSEC only decodes a srcip then the dstip will be set as the IP of the OSSEC 
agent.  This can be a cosmetic issue for AV type logs where a client reports an 
infection but there is  no dstip; so you will see the srcip of the client where 
the infection was found and the dstip will be the AV server the client reports 
to.

Original comment by thefla...@gmail.com on 18 Mar 2015 at 1:57

• Added labels: ****
• Removed labels: ****

[dougburks]

Submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/N5gpeSHmIlk/discussion

[dougburks]

Published:
http://blog.securityonion.net/2015/05/new-securityonion-sguil-agent-ossec.html