Getting Data In

Are there currently supported methods for ingesting and monitoring Suricata events in Splunk?

opoplawski
Explorer

Are there currently supported methods for ingesting and monitoring Suricata events in splunk?

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is an old TA on splunkbase (https://splunkbase.splunk.com/app/4242).  Perhaps it will help.

If not, there are a few ways to onboard data into Splunk.

Install a universal forwarder on the server to send log files to Splunk
Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
Use the server's API to extract data for indexing
Use Splunk DB Connect to pull data from the server's SQL database.
Have the application send data directly to Splunk using HTTP Event Collector (HEC).

What you mean by "supported"?  The TA is unsupported.  The onboarding methods are standard in Splunk, but Splunk Support will not help you with them as they are break/fix only.

---
If this reply helps you, Karma would be appreciated.
0 Karma

opoplawski
Explorer

I'm suspicious of the old TA for Suricata because it mentions splunk 7.2 and CIM 4.x, but I'll guess I'll test it out.

I guess I'm looking for "useful" more than anything else.  Something that will display the events in a useful way.


0 Karma

richgalloway
SplunkTrust
SplunkTrust

The old TA can be used as a guide to create your own TA that is more up-to-date.

Neither TA will display events as they only help onboard them.  For display purposes, you'll need an app (Search & Reporting should do).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...