After collecting Cloudtrail data with the Splunk App for AWS, how do we forward this data to ArcSight?

[vhdevera]

Hi,

We have a test setup for Splunk enterprise (in single instance) to receive Cloudtrail and was able to fulfill this using Splunk App for AWS. Now we would like to to send the collected data from Splunk into Arcsight. I read that we can do that by using Splunk forwarders, but not certain on what type of forwarder to use (like heavy, enterprise or universal...). Basicall, we want to send all collected data, be it in CEF or unparsed. What is the best path to do this, and can you point me to some documentation?

Thanks in advance

[dcharboneau_spl]

Take a look at the Splunk App for CEF:

https://splunkbase.splunk.com/app/1847/#/overview
http://docs.splunk.com/Documentation/CEFapp/1.0.0/DeployCEFapp/UsetheSplunkAppforCEF

From the documentation you can do the CEF Mappings then define the output to send to your ArcSight instance.

[vhdevera]

Hi dcharboneau_splunk,

Appreciate your response.
I am also looking at http://www.splunk.com/web_assets/pdfs/resources/Integrating_Splunk_with_Arcsight.pdf for overview but so far I have not seen detailed configuration on how to do this. Wondering if you know any document that discuss or show how to do it.