topic Re: Does Splunk supports new AWS Inspector v2? in Splunk Cloud Platform

Does Splunk supports new AWS Inspector v2?

saidtz — Wed, 16 Feb 2022 15:52:22 GMT

Is there possibility to ingest logs from AWS Inspector v2 into Splunk?

Re: Does Splunk supports new AWS Inspector v2?

razdansu — Tue, 21 Jun 2022 05:29:40 GMT

@saidtz Is there a possibility to ingest logs from AWS Inspector v2 into Splunk?

What are your findings on this? kindly help

Re: Does Splunk supports new AWS Inspector v2?

VatsalJagani — Tue, 21 Jun 2022 06:07:43 GMT

@saidtz , @razdansu - Have you tried the latest version of this Add-on?

https://splunkbase.splunk.com/app/5764/ (AWS Inspector)

I hope this helps!!!

Re: Does Splunk supports new AWS Inspector v2?

razdansu — Tue, 21 Jun 2022 06:37:21 GMT

@VatsalJagani @saidtz I m using AWS Add-on : 6.0.0 and splunk version Splunk Cloud : 8.2.2112.1

(https://docs.splunk.com/Documentation/AddOns/released/AWS/Inspector) following up on this document

Is it possible to collect logs with the following
permissions?
("inspector:*" may not be necessary)
And if so, is sourcetype supported?
"Action": [
"inspector2
Describe*",
"inspector2
List*"
],

Its about version 2 of inspector inspector v2 of aws as

I have set up to collect AWS Inspector logs.
Something seems to be wrong because it is not collected.
Is this add-on compatible with "Inspector v2"?

Re: Does Splunk supports new AWS Inspector v2?

VatsalJagani — Tue, 21 Jun 2022 06:59:11 GMT

@razdansu - The Add-on is built by Splunk, so you can ask that question to Splunk support.

I tried to find a proper document for it on Splunk, but couldn't find it. So Splunk support is the best place to go for this.

Re: Does Splunk supports new AWS Inspector v2?

saidtz — Tue, 21 Jun 2022 08:33:12 GMT

hey @razdansu. I could not find a way to ingest inspector v2 data with their add on. Instead, I generate new AWS Inspector report every day and I store it inside S3 bucket. Then, I just read that json file in splunk and that works fine. Glad if I helped

Re: Does Splunk supports new AWS Inspector v2?

razdansu — Tue, 21 Jun 2022 08:50:24 GMT

@saidtz which add 0n and its version are u using my friend

Re: Does Splunk supports new AWS Inspector v2?

saidtz — Tue, 21 Jun 2022 08:53:20 GMT

@razdansuI am using aws add on. Then simply read the file inside s3 bucket.

Re: Does Splunk supports new AWS Inspector v2?

Sushobit — Tue, 21 Jun 2022 09:05:02 GMT

@saidtz @razdansu confronted my internal development team and learned that inspector v2 is not supported in the existing version of AWS TA v6.0.0. They are working on it to add support for the same, so it will be added in an upcoming release. (Tentative date not known, most probably at the end of July)
Hope this helps!