The Graphite time-series database software is broken. The maintainers no longer have the will or the time to do what it takes to go forward. The project is stuck with feature creep and is being held back due to cruft. With a few swipes, it could become nimble again. Not …
Sageo is the technical building blocks for a new Livestatus based UI. It is up on gihub, under the project name smlacombe/sageo. 3 different systems could benefit from using or extending Sageo : Check_mk Multisite, Adagios, Shinken WebUI. The first (Multisite) because, it is running up to an architecture and …
Riemmann as a general purpose monitoring system for Microsoft Windows Riemann is an up and coming event stream processor. It is one of those projects that you take a look at and think this is nice, but not ready yet. A year has passed since I made that observation. …
OSSEC Tips and Quirks OSSEC is a pretty nifty tool to collect, parse and categorize events. Though it sometimes feels like a party entering the second level of the Proving Grounds of the Mad Overlord. You feel like your are getting there but you know some crazy vorpal bunny is …
OSSEC + Palo-Alto OSSEC out of the box does not include any decoders or rules for Palo-Alto Networks Next-Generation firewalls. This is part 2 of PaloAlto firewall integration with OSSEC. Read part one to learn how to create the basic decoder, a threat decoder and rules. In this part we will …
OSSEC + Palo-Alto OSSEC currently does not include any decoders or rules for Palo-Alto Networks Next-Generation firewalls. I just happen to have access to one of these devices and wished to get some logs into OSSEC. A little search on the interwebs only turned up a single relevant link. Xavier …
Having just come back from the SANS 2013 Orlando security conference, I want to share some random thoughts. SANS Instructors and speakers are top rate (once again) The invited vendors were pertinent to the conference and added to the experience SANS @ Night and special conferences were very much worth it …
The most astute will have noticed genDevConfig moving to github. This means, you can easily add more devices, submit corrections and improve this old school tool reborn for use with the up and coming Shinken monitoring system. Yup. genDevConfig 3.x, dedicated to creating Shinken configuration files is ready to rock. What does …
genDevConfig is in the process of being converted to output in a Shinken/Nagios configuration format. Nagios does not have any true discovery frameworks that generate configuration trees. It is more of a piecemeal affaire, where each acquisition check is responsible for knowing what it gets and how. Basic information is passed from …
Having just come back from the SANS Institute Orlando security conference, I want to share some random thoughts. SANS Instructors and speakers are top rate The invited vendors were pertinent to the conference and added to the experience SANS @ Night and special conferences were very much worth it and provided up …