Splunk ES fortinet new source

splunkcol — Wed, 18 Oct 2023 14:45:50 GMT

Hello,

I was given the administration of a Splunk Enterprise Security and I am not familiarized, I have always used manual queries from "Search & reporting" I have the knowledge level of Fundamentals 1 and 2.

Splunk ES currently works and I can see noticeable events from paloalto firewalls but recently configured fortinet logs and these are already coming in under an index called fortinet, when doing a normal query with index=fortinet I can see events but I see nothing from Splunk ES.

Exactly what do I need to do to get the fortinet events to be taken into account by Splunk ES and start logging notable events?

Re: Splunk ES fortinet new source

richgalloway — Wed, 18 Oct 2023 17:19:24 GMT

I strongly encourage you to take the free Using Splunk ES (Using Splunk Enterprise Security ) and the (not free) Administering Splunk ES (Administering Splunk Enterprise Security ) courses.

ES uses correlation searches to create notable events. A CS is like a saved search, but will a few added attributes. You can create a CS in ES by going to Configuration->Content Management and clicking on the New Correlation Search button.

topic Re: Splunk ES fortinet new source in Security

Splunk ES fortinet new source

Re: Splunk ES fortinet new source