How to forwarder logs from openedr externally

General
1

how to forwarder logs from openedr externally

2

hi @hzoutlook , could you please share your usecase so that I can fully understand your aim?

3

Like I’d like to have external SIEM to injest the logs from the openEDR.

4

OpenEDR platform already has a built-in SIEM where you can see all logs that are pushed from EDR agent.

5

Does this imply that there is no way to forward logs externally from OpenEDR? We have a use case to display these logs in another SIEM, Stellar Cyber. We can build the integration, we just need instructions on how to forward, log samples so we can build a parser, and a good understanding of what each of the fields in the log are.

6

You can export the logs from endpoints directly. Here is the documentation for that using FileBeat: openedr/getting-started/SettingFileBeat.md at main · ComodoSecurity/openedr · GitHub

1 Like
7

I assume if it’s locally hosted you can export what you want from Elastic, correct?