+1Hi all,
I find BindPlane Agent and BindPlane OP a great solution to manage log collection process.
I have an issue with the auditd log: the agent sent the data without any information about the host that generated the log. So, inside the Google SecOps SIEM, I cannot understand which server sent that log.
I use the file receiver to read the /var/log/audit/audit.log file and the chronicle exporter to send it to the SIEM.
Had anyone the same issue?
Thank you all.
Best,
Matteo
Best answer by cbryant
You will want to edit your Auditd config file to include the hostname. You should be able to do that by adding the following line to /etc/audit/auditd.conf then restart the auditd service:
name_format = hostname
+4You will want to edit your Auditd config file to include the hostname. You should be able to do that by adding the following line to /etc/audit/auditd.conf then restart the auditd service:
name_format = hostname
+16Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
