Splunk Enterprise Security

Whats the best way to get bro logs from an IDS to Splunk Enterprise Security thats running on a seperate server?

ssackrider
Explorer

Right now we have another instance of splunk and bro addon running on the IDS, the bro index is then forwarded to the main Splunk/ES. Assume we need another bro addon the main server (the messages are still ugly). Is this correct? If so how do we set an addon to monitor an index? Hope we're making this harder than it needs to be..

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi ssackrider,

Not sure what you mean by main Splunk/ES, but if this is your indexer, and you have already forwarded Bro logs to this server using a heavy forwarder, then you do not need to install another Bro Add-on on the indexer. However, if you also use a search head, you must also install the Bro Add-on on the search head in order to properly perform searches on indexed events.
In short, in a distributed environment, you must install the Bro Add-on on the search head, and either indexer or the heavy forwarder.
For more installation info, please refer to this section:

http://docs.splunk.com/Documentation/AddOns/released/BroIDS/Distributeddeployment#Distributed_instal...

Hope it helps, thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...