Nagios Plugins for Security Analytics

Here are some additional Nagios Plugins that might be useful if you are monitoring Security Analytics via Nagios. They are mainly used for graphing rather than warning but they could be easily adapted.@

They use the check_by_ssh command to run the scripts remotely on the different appliances.

$USER1$/check_by_ssh -H $HOSTADDRESS$ ./index-profile-1.2-nagios.pl -l root -t 60

The scripts are a combination of work from colleagues  (Lee Kirkpatrick Maxim Siyazov Davide Veneziano) and my own efforts.

Note these scripts have the admin netwitness credentials hardcoded inside them, which is not best security practise!

Script to Get Current Log Decoder Capture Rate

Command Line: ./getEPS_logdecoder.sh

Example Output: capture rate: 0|capture_rate=0;;

Install on: Log Decoder

Script to get Log Collection EPS

Install on Log Collector

Command Line: ./getEPS_nagios.sh

Example Output: Syslog: 0 SDEE: 0 Windows: 0 Checkpoint: 0 VMWare: 0 File: 0 Netflow: 0 ODBC:  Total: 0|Syslog=0 SDEE=0 Windows=0 Checkpoint=0 VMWare=0 File=0 Netflow=0 ODBC=0 Total=0;;

Script to Monitor Warehouse Streams Behind Value

Install on Warehouse Connector

Command Line: ./get_Warehouse.sh

Example Output: Elastic3: 28815 LogStream3: 8404 PacketStream3: 1860 |Elastic3=28815 LogStream3=8404 PacketStream3=1860 ;;

Script to Monitor Index Keys that are over 70% Full

Install on Concentrator

Command Line:  ./index-profile-1.2-nagios.pl

Example Output: param=100.00% user.session=100.00% stransport=90.61% ip.srcport=82.57% |param=100.00% user.session=100.00% stransport=90.61% ip.srcport=82.57% ;;