topic Re: Syslog SSL - FortiWeb Cloud to Splunk Enterprise in Getting Data In

Syslog SSL - FortiWeb Cloud to Splunk Enterprise

solg — Fri, 03 Jan 2025 14:09:18 GMT

We need to connect a FortiWeb Cloud with a Splunk Heavy Forwarder.

It is over internet so SSL must be used.

We are receiving the test event correctly using TCP (without SSL)

But it is not being decrypted with SSL

Reviewing the documentation, we do not undesrtand how to configure the ssl-tcp input, and what certificates should be configured in FortiWeb.

We have seen some solutions centered in SSL between Splunk components, but none of them explain what certificates should be configured on the source.

Does anyone know how to make this work? With FortiWeb or any other third party input

kiran_panchavat — Sat, 04 Jan 2025 05:55:23 GMT

I believe the link below will assist you with your question.

solg — Fri, 07 Feb 2025 11:58:43 GMT

We succesfully configured FortiWeb SaaS -> Splunk SSL syslog via inputs.conf

[tcp-ssl:6514]
index = <index>
sourcetype = fwbcld_log
disabled = 0

[SSL]
requireClientCert = false