All Apps and Add-ons

Configure AWS Guardduty Logs

wvalente
Explorer

Guys,

I'm trying to set up Guardduty log collection, but so far I'm not successful.

I have a heavy forwarder that forwards logs to the indexer and the search head queries the data in the indexer.

I configured the add-ons on the necessary platforms (heavy forwarder and search head), I configured the accounts needed to forward the logs.

The logs are being sent via the SQS queue. The logs arrive at the indexer, but I can't get the dashboard populated (Splunk App for AWS and aws_guardduty).

On the dashboards, in the 'AccountID' menu, a message appears
"Search produced no results."

I also tried to configure via HEC, but there is an error message that it cannot connect to the platform.

Can someone help me?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...