topic Re: Is it possible to use only one listener for the Trend Micro Deep Security for Splunk app (by limiting sourcetypes)? in All Apps and Add-ons https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297652#M35564 <P>This sounds very feasible. Thanks for your answer. </P> Sat, 26 Aug 2017 06:06:41 GMT elvintheo 2017-08-26T06:06:41Z Is it possible to use only one listener for the Trend Micro Deep Security for Splunk app (by limiting sourcetypes)? https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297649#M35561 <P>I know 'Trend Micro Deep Security for Splunk' app by default creates 6 listeners each listening at unique UDP ports. And, this is to classify/separate events based on the source. <BR /> Is there a way we can only use one UDP port to listen to events. So, can we use one sourcetype 'deepsecurity' instead of multiple sub sourcetypes like: deepsecurity-antimalware, deepsecurity-web_reputation etc?</P> Tue, 22 Aug 2017 17:55:18 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297649#M35561 elvintheo 2017-08-22T17:55:18Z Re: Is it possible to use only one listener for the Trend Micro Deep Security for Splunk app (by limiting sourcetypes)? https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297650#M35562 <P>Yes you can. I do it using a syslog server between Splunk and TMDS. </P> <P>We send syslog from TMDS in cef format to a syslog server and ingest the data into Splunk as sourcetype = deepsecurity:cef</P> <P>So theoretically you could send the CEF data directly to Splunk and listen on one port with sourcetype=deepsecurity:cef</P> Tue, 22 Aug 2017 19:45:03 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297650#M35562 jkat54 2017-08-22T19:45:03Z Re: Is it possible to use only one listener for the Trend Micro Deep Security for Splunk app (by limiting sourcetypes)? https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297651#M35563 <P>Same here </P> Wed, 23 Aug 2017 16:55:41 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297651#M35563 klaxdal 2017-08-23T16:55:41Z Re: Is it possible to use only one listener for the Trend Micro Deep Security for Splunk app (by limiting sourcetypes)? https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297652#M35564 <P>This sounds very feasible. Thanks for your answer. </P> Sat, 26 Aug 2017 06:06:41 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297652#M35564 elvintheo 2017-08-26T06:06:41Z Re: Is it possible to use only one listener for the Trend Micro Deep Security for Splunk app (by limiting sourcetypes)? https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297653#M35565 <P>Does the trendmicro app for Splunk work with sourcetype = deepsecurity:cef</P> Sun, 27 Aug 2017 04:00:33 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297653#M35565 salonyag 2017-08-27T04:00:33Z Re: Is it possible to use only one listener for the Trend Micro Deep Security for Splunk app (by limiting sourcetypes)? https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297654#M35566 <P>Not 100%. Maybe it's just sourcetype=deepsecurity</P> Sun, 27 Aug 2017 05:40:20 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297654#M35566 jkat54 2017-08-27T05:40:20Z Re: Is it possible to use only one listener for the Trend Micro Deep Security for Splunk app (by limiting sourcetypes)? https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297655#M35567 <P>Check out what's in the TA in props.conf</P> Sun, 27 Aug 2017 05:41:06 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Is-it-possible-to-use-only-one-listener-for-the-Trend-Micro-Deep/m-p/297655#M35567 jkat54 2017-08-27T05:41:06Z