Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic!
1. Describe your incident:
Hi!
Does anyone have some document that what can be done in Graylog to deal with security in your organization.
I have done small part of Failed login from AD and Failed login from vpn. But want to do more and what can Graylog provide and what can I implement.
Some ideas that I can implement?
2. Describe your environment:
OS Information:
Package Version:
Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
A standard use of a platform like Graylog is to feed in your firewall logs, and then check the source and destination IPs of each request against geolocation and against threat libraries to detect external access/threats or internal illict activity. Good for detecting if someone is using the office network for torrenting or cryptomining too!
If your going to do this yourself there are things to consider. The correct and maybe separate INPUTs for all your devices in case you need to create extractor. Then you need to make sure the correct fields are generated not only for you Windows, Linux, Firewalls, etc… Next you will need to create stream to hold these filtered messages for alerting, Dashboards, Widget etc…
Here is an example of my lab, please take note this Dashboard for my Linux device ONLY.
On both of those screenshots there is a stream with Event Definition attached for alerting if need be.
I’m not going to lie , it will take some time to set up and testing. Once your created the basic configuration it will work.
So this is what I did so far.
I have started with Windows DC. I am parsing logs from my DC which is all the AD roles on it.
I am using nxlog and sending only specific event ids because of the limit issue as I am only allowed to use 5G per day.
I have created indices for my DC and then created stream for it. Then I go to search, select the stream which is domain controller and in the perform search box I write 4740 and I can see A user account was locked out.
I created a Dashboard name DomainController.
Now how can I create dashboards using these logs. Thats What I am looking for.
@gsmith Thanks. I have done most of the part. Its only your widgets I am interested in. If you share screetshot of few of them that I can what settings you have for them.
Few things I want to ask you.
you have different settings then my graylog.
I dont have all these options. Like in Metrics section I dont have Field or name attributes.
