Recommendations on Linux SIEM tools?

[Deleted member 977321]

I've seen two threads here discuss OSSEC, Splunk, and LogWatch. However, both are well over 5 years old. What works best with dedicated cPanel server environments? Which is best for learning more about cybersecurity and incident response in general?

 

[SamuelM]

Hello @Jay3570

None of these software solutions would integrate with existing features of cPanel and WHM. So I will let other community members weigh in on the subject. Can you provide any specific details about what you are trying to accomplish, or which security concerns or most important to you?

 

[Deleted member 977321]

Can you specify why they wouldn't work with cPanel/WHM? I've had no issues installing it or pulling server logs. I'm looking to learn more about ways to organize and visualize server log data, not simply website analytics.

 

[cPRex]

I think the "why" is more so "we don't do any testing of these on our side so no guarantee it's doing to work." It doesn't mean it specifically *won't* work, but that there's no guarantee those functions will work, or could disrupt existing tools on the system.

 

[Deleted member 977321]

I figured that's what it meant, but "None of these software solutions would integrate with existing features" seems more negative than simply saying "we can't guarantee."

 

[Deleted member 977321]

I see Kibana along with the full ELK Stack (Elasticsearch and Logwatch) could also be included here. Is Linux server monitoring that rarely discussed?

 

[cPRex]

I tried a custom search of the forums to get more details and I see there are quite a few discussions on various tools, both for sites and the machine itself:

site:forums.cpanel.net monitoring - Google Search