Skip to content

Commit 8f60434

Browse files
committed
Update README.md
1 parent b27ebe6 commit 8f60434

1 file changed

Lines changed: 2 additions & 3 deletions

File tree

README.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,15 @@ Modsecurity audit log ingestor configuration for Logstash
1010
Tested and running in production environments w/ logstash v.1.3.3 and v1.4.1+ (does NOT work with Logstash 1.4.0)
1111

1212
see: http://logstash.net/
13-
13+
see: http://www.slideshare.net/prajalkulkarni/attack-monitoring-using-elasticsearch-logstash-and-kibana
1414
see: https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-2-Data-Formats
15-
1615
see: http://bitsofinfo.wordpress.com/2013/09/19/logstash-for-modsecurity-audit-logs/
1716

1817
license: http://www.apache.org/licenses/LICENSE-2.0
1918

2019
### Overview
2120

22-
This example configuration file has been used as the basis to process many ModeSecurity audit logs with lots of different variance in regards to which A-K sections are present. At a minimum this is a good starting point to start tackling a complex log format and you can customize it to you needs.
21+
This example (working) configuration file has been used as the basis to process millions of ModeSecurity audit logs with lots of different variance in regards to which A-K sections are present. At a minimum this is a good starting point to start tackling a complex log format and you can customize it to you needs.
2322

2423
Also note that ModSecurity Audit logs can definately contains some very sensitive data (like user passwords etc). So you might want to also take a look at using Logstash's Cipher filter to secure certain message fields in transit if you are sending these processed logs somewhere else: [http://bitsofinfo.wordpress.com/2014/06/25/encrypting-logstash-data/](http://bitsofinfo.wordpress.com/2014/06/25/encrypting-logstash-data/)
2524

0 commit comments

Comments
 (0)