Skip to content

Commit 07b1890

Browse files
committed
Update README.md
1 parent 88de01e commit 07b1890

1 file changed

Lines changed: 8 additions & 4 deletions

File tree

README.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
logstash-modsecurity
22
====================
33

4-
Example Modsecurity audit log ingestor configuration for Logstash
4+
Modsecurity audit log ingestor configuration for Logstash
55

6-
author bitsofinfo.g[at]gmail.com
6+
**author**: bitsofinfo.g[at]gmail.com
77

8-
built/tested w logstash v.1.3.3 and v1.4.1+ (does NOT work with Logstash 1.4.0)
8+
### Overview
9+
10+
Tested and running in production environments w/ logstash v.1.3.3 and v1.4.1+ (does NOT work with Logstash 1.4.0)
911

1012
see: http://logstash.net/
1113

@@ -15,7 +17,9 @@ see: http://bitsofinfo.wordpress.com/2013/09/19/logstash-for-modsecurity-audit-l
1517

1618
license: http://www.apache.org/licenses/LICENSE-2.0
1719

18-
NOTE: this is not perfect and I am no Ruby expert however this worked when processing quite a bit of high volume mod-sec logs with lots of different variations in what A-K sections were and were not present. At a minimum its a good starting point to start tackling a complex log format.
20+
### Overview
21+
22+
This example configuration file has been used as the basis to process many ModeSecurity audit logs with lots of different variance in regards to which A-K sections are present. At a minimum this is a good starting point to start tackling a complex log format and you can customize it to you needs.
1923

2024
Also note that ModSecurity Audit logs can definately contains some very sensitive data (like user passwords etc). So you might want to also take a look at using Logstash's Cipher filter to secure certain message fields in transit if you are sending these processed logs somewhere else: [http://bitsofinfo.wordpress.com/2014/06/25/encrypting-logstash-data/](http://bitsofinfo.wordpress.com/2014/06/25/encrypting-logstash-data/)
2125

0 commit comments

Comments
 (0)