All Apps and Add-ons

What is the appropriate configuration for the ClamAV app to send data to Splunk?

p1rate5s
Explorer

We have setup the ClamAV app for Splunk and are tweaking the config of Clam on the clients to send the appropriate amount of data to Splunk to populate the dashboards. Has anyone done this and can offer the appropriate ClamAV config?

Tags (2)
0 Karma

pbalsley
Path Finder

Yes the easiest way is via syslog.

Run clamav on each host. I run it like this:

/usr/bin/clamscan -i -r $SCAN_DIR $EXCLUDE --log=$LOG_FILE --stdout | logger -i -t clamav -p auth.alert

Also make sure to update freshclam config
- Edit the /etc/freshclam.conf file
- Make sure setting LogSyslog yes is enabled.

If your host already sends all of it's syslog to splunk it should work for you.

woodcock
Esteemed Legend

Please elaborate. What does this command do? Does it need to be run only once? What are the environment variables supposed to have in them? This is a very incomplete answer.

0 Karma

pbalsley
Path Finder

A bit more clarity:

The default behavior of the app is to monitor the sourcetype syslog for CLAMAV logs and it looks for the keyword "clamav" in the syslog messages.

The example above will pipe all scan data to "logger" to send it into the syslog system with the correct keyword.

I run a few different clamscans via cron. Some once a day and others once a week. Just depends on how and what you want to scan. It is up to you on how you want to do this. There is no standard. Please read the man page to understand all possible uses.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...