topic Re: Are there currently supported methods for ingesting and monitoring Suricata events in Splunk? in Getting Data In

Are there currently supported methods for ingesting and monitoring Suricata events in Splunk?

opoplawski — Thu, 17 Nov 2022 18:57:16 GMT

Are there currently supported methods for ingesting and monitoring Suricata events in splunk?

Re: Are there currently supported methods for ingesting and monitoring Suricata events in Splunk?

richgalloway — Thu, 17 Nov 2022 20:16:29 GMT

There is an old TA on splunkbase (https://splunkbase.splunk.com/app/4242). Perhaps it will help.

If not, there are a few ways to onboard data into Splunk.

Install a universal forwarder on the server to send log files to Splunk
Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
Use the server's API to extract data for indexing
Use Splunk DB Connect to pull data from the server's SQL database.
Have the application send data directly to Splunk using HTTP Event Collector (HEC).

What you mean by "supported"? The TA is unsupported. The onboarding methods are standard in Splunk, but Splunk Support will not help you with them as they are break/fix only.

Re: Are there currently supported methods for ingesting and monitoring Suricata events in Splunk?

opoplawski — Thu, 17 Nov 2022 20:41:36 GMT

I'm suspicious of the old TA for Suricata because it mentions splunk 7.2 and CIM 4.x, but I'll guess I'll test it out.

I guess I'm looking for "useful" more than anything else. Something that will display the events in a useful way.

Re: Are there currently supported methods for ingesting and monitoring Suricata events in Splunk?

richgalloway — Thu, 17 Nov 2022 21:21:00 GMT

The old TA can be used as a guide to create your own TA that is more up-to-date.

Neither TA will display events as they only help onboard them. For display purposes, you'll need an app (Search & Reporting should do).