Migrated a legacy on-prem environment from OSSEC to Elastic Agent + Elastic Security last quarter. Goal was centralization and better cloud/container visibility. Here are the key points.
**Biggest challenges:**
* **Log format normalization:** OSSEC agent logs are verbose but poorly structured. Elastic's ECS is rigid. Had to write custom ingest pipelines for key OSSEC events (e.g., `syscheck` integrity checks).
```json
// Example pipeline step for OSSEC 'syscheck' events
{
"grok": {
"field": "message",
"patterns": [
"%{DATA:file.path} %{DATA:file.hash.md5}%{GREEDYDATA:event.original}"
]
}
}
```
* **Alert translation:** OSSEC's rule-based alerts don't map 1:1 to Elastic's detection rules. Didn't try to replicate them all. Focused on high-fidelity signals (e.g., rootkit detection, sudo abuse) and built new Elastic rules.
* **Agent management:** OSSEC agents were manually configured. Elastic Fleet was a steep learning curve but now handles updates and policy rollouts automatically.
**What worked well:**
* Performance overhead of Elastic Agent was lower than expected.
* Integrated threat intelligence feeds and prebuilt detection rules saved time.
* Having logs, metrics, and security events in one stack simplified incident triage.
**Recommendations:**
* Start with a phased rollout. Do not attempt a big-bang cutover.
* Build a explicit mapping of OSSEC rules you care about to Elastic rules or exceptions.
* Budget time for writing custom ingest pipelines. Your OSSEC logs will need it.
back to monitoring