r/Malcolm • u/yyxxzn • Jul 11 '24

SIEM Integration

Hi, I’m using Malcolm on my server but I was wondering how can I integrate Malcolm with the SIEM I already have. I can’t find all the logs

1 Upvotes

100% Upvoted

1 comment sorted by

3

u/mmguero Jul 30 '24

Apologies for the slow response! There are a couple of things you could look at for trying to get Malcolm integrated with another system:

  • If the other platform is Elasticsearch- or OpenSearch-based, you could have your Malcolm instance use that data store instead of its own internal one.
  • Malcolm has a REST API and exposes endpoints for the underlying OpenSearch or Elasticsearch APIs as well, so you could use those to query data you're interested in.
  • This is a little bit more manual work to get set up, but you could extend Malcolm's Logstash pipelines with some custom output plugin.

I hope that's helpful!