topic Re: Does anyone have a document/steps to guide me to do a SIEM migration from Qradar to Splunk? in Getting Data In

Does anyone have a document/steps to guide me to do a SIEM migration from Qradar to Splunk?

alexinkedia1 — Wed, 21 Sep 2022 18:39:30 GMT

Does anyone have a document/steps to guide me to do a SIEM migration from Qradar to Splunk

Re: Does anyone have a document/steps to guide me to do a SIEM migration from Qradar to Splunk?

richgalloway — Thu, 22 Sep 2022 00:25:18 GMT

That usually involves a Professional Services engagement. It's not a simple task and Splunk has no public documentation on it.

Re: Does anyone have a document/steps to guide me to do a SIEM migration from Qradar to Splunk?

gcusello — Thu, 22 Sep 2022 06:47:06 GMT

Hi @alexinkedia1,

as @richgalloway said, this is a job for Splunk Professional Services or for a Splunk Architect, specialized on Enterprise Security, that already did it.

There isn't any available documentation, only the knowledge of the ones who did it.

For the migration of the Correlation Searches, you can find a very useful tool at https://uncoder.io/ and https://github.com/SigmaHQ/sigma

Ciao.

Giuseppe