Graylog2 / Graylog2/graylog2-server
Verify Elasticsearch data integrity
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
It would be nice if Graylog could check Elastcisearch indices integrity and notify if one have changed.
## Current Behavior
At the moment we can't know if someone modified an Elasticsearch index.
## Possible Solution
When index rotation happens you could calculate the hash of the index and then you can verify this hash frequently (daily ?).
We also need to know if an index have been deleted by something other than the retention policy.
It would be nice if a notification would be sent in the Graylog interface, but we also need Graylog generates a log so we could use Graylog functions to be alerted (for example by sending an email, or creating a ticket).
## Context
When you work with logs it's important to be sure they have not been modified.
For example an attacker could modify logs in order to not be detected.
Moreover the law in many countries says we need to retain logs for a certain period, and it's only useful if we can prove logs have not been modified.
I posted on the community a long time ago but I don't see any news even in the entreprise version: https://community.graylog.org/t/data-integrity-checking/3090
## Your Environment
* Graylog Version: 3.0
* Elasticsearch Version: 6.7
* MongoDB Version: 4
* Operating System: CentOS 7
Contributor guide
Assessment
This issue has not been assessed yet.