Getting Data In

Using splunk forwarder to send system/application logs to another SIEM like ArcSight

balbano
Contributor

Hi Guys,

We are using a third party solution to help us monitor event logs and they use ArcSight as their SIEM Solution.

Since Splunk is sending both system logs and application logs to our indexers, I would like to know what is the best way to forward events to their ArcSight solution. We are hosting a VM appliance tool within our infrastructure that will forward the events to the third party monitoring solution but wanted some clarification on some items:

  1. To send the data, is it just a matter of configuring outputs.conf on the forwarder to send data to the VM appliance?
  2. Is it possible to still use SSL within Splunk to send data from the forwarder to the ArcSight appliance?
    1. Is there anything else I may be missing that I need to be aware of?

If someone can help me clarify these items that would be great.

Thanks.
Brian

davecroto
Splunk Employee
Splunk Employee

You would have to parse the data into CEF format, but it is possible.

Google and download the PDF:

Integrating Splunk with ArcSight

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...