Installing SIEM Agent
- Endpoints/nodes should be able communicate to SIEM Appliance
Run the following commands to install SIEM Agent on Linux VMs
wget https://raw.githubusercontent.com/snappyflow/apm-agent/master/siemagent_installer.sh -O siemagent_installer.sh
chmod +x siemagent_installer.sh
To start with the installation, follow the given command and provide SIEM Appliance's IP and provide values for
Name is the host name and the
appName are the project name and application name used on the Snappyflow portal.
sudo ./siemagent_installer.sh install <ip> <projectName> <appName> <instanceName>
Providing tags are crucial for endpoints to appear under the correct Project and Application in SnappyFlow Portal.
Validating Agent Installation
To validate connection between SIEM Appliance and SIEM Agent, check the following:
- Make sure SIEM Appliance's IP is updated in
/var/ossec/etc/ossec.confconfig file in SIEM Agent machine.
- Login to SIEM Appliance and run the command
sudo /var/ossec/bin/agent_control -lc, it lists all the connected agents.
File Integrity Monitoring (FIM) Configuration
The FIM module is part of the SIEM agent and it runs periodic scans of the system and stores the checksums and attributes of the monitored files in a local database. The module looks for the modifications by comparing the new files’ checksums to the old checksums. All detected changes are reported to the SIEM manager (SIEM Appliance).
The FIM synchronization is based on periodic calculations of integrity between the SIEM agent and the SIEM manager databases, updating in the SIEM manager only those files that are outdated, optimizing the data transfer of FIM. Anytime the modifications are detected in the monitored files and/or registry keys, an alert is generated.
By default, each SIEM agent has the syscheck enabled and preconfigured, but it is recommended to review and amend the configuration of the monitored host.
Configuration for FIM check i.e.
<syscheck> is located in agent's config file
To change the frequency of periodic scans, follow the given steps:
- Locate <syscheck> block in the file and update frequency field to desired value. Unit of this Value is seconds.
- Save the file and restart SIEM agent service
sudo ./siemagent_installer.sh restart
Uninstalling the SIEM Agent
To uninstall the agent , run the following command:
sudo ./siemagent_installer.sh uninstall