Forum Discussion
KrishnaS
Nimbostratus
NimbostratusF5 BIG-IP DNS/Audit Logs — Structured Format for SIEM Ingestion
Hello Team, We are working on adding ingestion support for F5 BIG-IP DNS and Audit logs into a SIEM, with the goal of normalising events to the OCSF standard. For other BIG-IP event types, we use Te...
jainzeel13
Altocumulus
AltocumulusHello Jeff_Granieri
Thank you for sharing the bash script.
We’ve tested it and wanted to clarify: will this script convert all types of audit logs into JSON format? For example, if we have different categories such as authentication failure (have a message fields in which it's metioned that it failed to authenticate), authentication successes, and network-related audit logs etc, will the script handle and convert each of these log types correctly into JSON?
Jeff_Granieri
Employee
EmployeeHi jainzeel13 ,
Its looking at /var/log/audit. You should test each audit message to confirm the script covers that you need. Feel free to make any changes to adjustments as needed.
