All Apps and Add-ons

CyberArk Log format coming into Splunk

abheeks
New Member

Hi All,

We are trying to ingest the cyberark data into Splunk. CyberArk is sending logs into a syslog server from where we have tried to ingest into Splunk. But the logs are coming into the syslog server where we find the below issue of getting square braces like below .

|Backup[Metadata|5|act="Backup]
Prepare[Backup] Backup Metadata"
Monitor[FW] end|5|act="Monitor FW Rules end"
Retrieve[File|5|act="Retrieve]

Due to this the field "cef_name" is coming as below

Backup[Metadata

Retrieve[File
Monitor[FW

So please let me know if the above format is correct and accepted? If not then we will check in the CyberArk if there is an issue in the log format.

Regards,
Abheek

0 Karma

nickhills
Ultra Champion

Hi Abheek,

In CyberArk you can load an xsl document which configures the CEF format to an appropriate type.
If you are planning on using the CyberArk TA, the TA comes with a file named SplunkCIM.xsl which will allow the TA to normalise your events into the CIM compliant format.

It seems possible you may have a different xsl file loaded which is amending the log format CyberArk is sending.

With it configured correctly, your CyberArk logs should look like this in Splunk. [REDACTED]

Jan 12 12:56:42 IP.IP.IP.IP 1 2018-01-12T12:56:42Z HOSTNAME CEF:0|Cyber-Ark|Vault|VERSION|106|Update File Category|5|act="Update File Category" suser=USERNAME fname=Root\268\CyberArk.Reports.xml dvc= shost=HOSTIP dhost= duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2="SAFENAME" cs3Label="Device Type" cs3= cs4Label="Database" cs4= cs5Label="Other info" cs5="ReportFailureReason" cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=  msg=

http://docs.splunk.com/Documentation/AddOns/released/CyberArk/Setup#Configure_EPV_to_produce_syslog

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...