topic Re: Splunk App for Linux Auditd Log in Splunk Enterprise

Splunk App for Linux Auditd Log

Symon — Mon, 26 Feb 2024 05:16:45 GMT

Hello Sirs,

I would like to know the most useful Splunk App that can be suitable for Linux Auditd events. I have Linux devices such as Mangement Servers, DNS, HTTP Servers, Firewall, etc. These logs carried by both Syslog Forwarder and Heavy forwarders.

Please suggest how to monitor the audit logs by which Splunk App?

Thanks a bunch.

Re: Splunk App for Linux Auditd Log

kiran_panchavat — Wed, 28 Feb 2024 15:22:33 GMT

@Symon

To effectively monitor Linux Auditd events in Splunk, you can use the Splunk Add-on for Linux.

This add-on allows you to collect and analyze audit logs from your Linux devices. Here’s how you can set it up:

Configure AuditD to Send Data to the Splunk Add-on for Linux:

https://docs.splunk.com/Documentation/AddOns/released/Linux/Configure4
https://splunkbase.splunk.com/app/833

This Add On for linux Auditd allows Administrators to make their data OCSF Compliant and CIM compliant for related Linux Auditd Events

https://preview.splunkbase.splunk.com/app/7045

Re: Splunk App for Linux Auditd Log

Symon — Fri, 01 Mar 2024 05:00:48 GMT

Thanks. Noted sir.