Graylog2 / Graylog2/graylog2-server

Verify Elasticsearch data integrity

Open
#6,178 2 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

It would be nice if Graylog could check Elastcisearch indices integrity and notify if one have changed.

## Current Behavior

At the moment we can't know if someone modified an Elasticsearch index.

## Possible Solution

When index rotation happens you could calculate the hash of the index and then you can verify this hash frequently (daily ?).
We also need to know if an index have been deleted by something other than the retention policy.
It would be nice if a notification would be sent in the Graylog interface, but we also need Graylog generates a log so we could use Graylog functions to be alerted (for example by sending an email, or creating a ticket).

## Context

When you work with logs it's important to be sure they have not been modified.
For example an attacker could modify logs in order to not be detected.
Moreover the law in many countries says we need to retain logs for a certain period, and it's only useful if we can prove logs have not been modified.
I posted on the community a long time ago but I don't see any news even in the entreprise version: https://community.graylog.org/t/data-integrity-checking/3090

## Your Environment

* Graylog Version: 3.0
* Elasticsearch Version: 6.7
* MongoDB Version: 4
* Operating System: CentOS 7

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.