Recently had a need to take tons of raw ModSecurity audit logs and make use of them. Ended up using Logstash as a first stab attempt to get them from their raw format into something that could be stored in something more useful like a database or search engine. Nicely enough, out of the box, Logstash has an embeddable ElasticSearch instance that Kibana can hook up to. After configuring your Logstash inputs, filters and outputs, you can be querying your log data in no time…. that is assuming writing the filters for your log data takes you close to “no time” which is not the case with modsec’s more challenging log format.
After searching around for some ModSecurity/Logstash examples, and finding only this one (for modsec entries in the apache error log), I was facing the task of having to write my own to deal w/ the modsecurity audit log format……arrggg!
So after a fair amount of work, I ended up having a Logstash configuration that works for me… hopefully this will be of use to others out there as well. Note, this is certainly not perfect but is intended to serve as an example and starting point for anyone who is looking for that.
**The Modsecurity Logstash configuration file (and tiny pattern file) is located here on Github: **https://github.com/bitsofinfo/logstash-modsecurity
- Get some audit logs generated from modsecurity and throw them into a directory
- Edit the logstash modsecurity config file (https://github.com/bitsofinfo/logstash-modsecurity) and customize its file input path to point to your logs from step (1)
- Customize the output(s) and review the various filters
- On the command line: java -jar logstash-[version]-flatjar.jar agent -v -f logstash_modsecurity.conf
#security #elasticsearch #logstash #modsecurity
