How to Forward HPE Morpheus Audit Logs to a SIEM Using Dual Log Sources

·2 views

HPE Morpheus Enterprise uses two separate internal loggers — AuditLogService and ActivityService — that capture different aspects of system activity, and both are needed for complete audit coverage in a SIEM. AuditLogService records HTTP controller-level actions such as logins and API calls, including source IP addresses, while ActivityService tracks object-level changes like provisioning and backups but without source IP data. Neither log alone provides a full picture of security-relevant events, such as privileged user creation, making a two-feed setup necessary for effective correlation rules. The working configuration forwards both logs to a SIEM as CEF over syslog using rsyslog file-tailing, with no plugins, scheduled jobs, or API polling required. The setup has been tested on Morpheus versions 8.1.x and 9.0.x running on RHEL 8, with logs forwarded into IBM QRadar.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Apache Kafka: what it is, when to use it, and its key trade-offs

Apache Kafka is an open-source distributed messaging system that stores data streams in a durable, ordered, and fault-tolerant manner. Messaging platforms like Kafka allow multiple systems to exchange information asynchronously through an intermediary, without services calling each other directly. Kafka stands out from traditional brokers such as RabbitMQ and SQS because messages persist after being consumed, making it well suited for high-volume, real-time scenarios like e-commerce order processing and IoT sensor networks. Among its main advantages are high throughput, real-time processing, resilience, and support for multiple simultaneous consumers. However, Kafka can be overkill for low-traffic applications and carries a steep learning curve along with significant configuration and operational complexity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Anthropic Engineer Advises Deleting Claude.md Files as Opus 5 Needs Far Fewer Instructions

Boris Cherny, the engineer behind Claude Code, told a Y Combinator audience that users should periodically delete their CLAUDE.md files, custom skills, and hooks to let Opus 5 demonstrate its improved capabilities. Anthropic itself removed over 80% of Claude Code's internal system prompt before shipping the new model, having found that most instructions were compensating for limitations in earlier versions that no longer exist. Cherny explained that Anthropic used a line-by-line ablation process to determine which prompt instructions still carried weight and which had become redundant scaffolding. Opus 5's broader instruction retrieval, built-in self-verification, and long-horizon task handling mean that instruction files tuned for Claude 4.x can behave erratically on the newer model even without any changes by the user. Developers are advised to audit existing instruction files, as much of their content likely addressed past model weaknesses rather than encoding genuinely necessary guidance.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Insufficient source content to generate a reliable headline

The source material provided does not contain enough article text to produce an accurate, factual summary. Only metadata such as the article URL, Hacker News comments link, and engagement metrics were included. Reproducing or inferring claims without the full article content would risk fabricating facts. Please provide the complete article text for proper summarization.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer audited a 5.5 GB AI dataset by downloading less than 1% of it

A developer discovered a 5.5 GB Chinese astrology AI training dataset on a popular repository and grew suspicious when the sample count of 518,400 matched a perfect nested loop formula rather than real observations. Using HTTP range requests, they downloaded only 48 MB — about 0.8% of the total — by fetching the ZIP central directory and targeted file shards. The audit revealed that the dataset's 781 data shards appeared algorithmically generated rather than empirically collected. More strikingly, a proprietary content library explicitly excluded from the open-source GitHub repo was found bundled inside the release archive, buried nearly 6 GB deep where few would look. The case highlights both a practical technique for sampling large archives cheaply and a cautionary note about assuming release contents match what a repository publicly discloses.

0 comments Read more at DEV Community