topic Re: Arcsight 2 Splunk Transition in Splunk Dev

Arcsight 2 Splunk Transition

SamHTexas — Mon, 04 Jan 2021 17:39:33 GMT

Looking for new resources to transition from ArcSight to Splunk please. The resources found on Micro Focus site are very old. Links & docs are much appreciated. If you have done this before any Do's & Don't are welcomed. Thank u

Re: Arcsight 2 Splunk Transition

richgalloway — Mon, 04 Jan 2021 18:32:00 GMT

Splunk has an entire Professional Services practice for this so it's not something that is easily summarized in a forum posting. That's also why documentation is hard to come by.

You'll want the Splunk Enterprise Security app. It's a premium product (extra cost), but is what Splunk offers as a SIEM. Replacing ArcSight with core Splunk is likely to lead to disappointing results.

The first step in the transition is to install Splunk and start sending your data to it. You should be able to send the data to both ArcSight and Splunk simultaneously.

Next, you'll need to map your ArcSight rules to Splunk searches. Run the searches and compare the results to those reached by ArcSight. Adjust the searches until you get the desired results.

Use ArcSight and Splunk side-by-side for a while to confirm Splunk is acting as expected. Once you're confident in it, shut down ArcSight.

Re: Arcsight 2 Splunk Transition

SamHTexas — Tue, 05 Jan 2021 02:08:05 GMT

I appreciate your response & Thank you for your time. I have a couple of questions

What role does the Splunk Ent. Security app has with such transition?

Would you elaborate on mapping Arcsight rules to Splunk searches a bit & where such instructions are found.

Thanks again

Re: Arcsight 2 Splunk Transition

richgalloway — Tue, 05 Jan 2021 15:15:46 GMT

Splunk Enterprise Security is Splunk's SIEM product. It is the replacement for ArcSight.

I'm not aware of any instructions for mapping ArcSight rules to Splunk searches. It's probably a tedious manual process of looking at each ArcSight rule and then looking at each Splunk search to see which is a good match. If a match is not found then write an equivalent Splunk search.