https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106713#M22445 <P>For anyone who has used the snare agent - I've been testing snare agent for windows and snare server, and I've gotten the desired security event logs from the agent (- logins and specific file access) to the server. Then BLAM - the quote came in a lot higher than I expected. So I set up a splunk receiver, but the server running the agent doesn't show up as a source in Splunk Search. </P> <P>Free agent is udp only, so I've tried ports 514 and 6161, and tried source types of both windows_snare_syslog and plain old syslog. I have those ports open in the firewall on the splunk receiver. I've restarted the snare and splunk services.</P> <P>I know about the universal forwarder, but I'd really rather use the snare agent because it's already set to output only the info that I need.</P> <P>What am I missing in my setup? Thanks.</P> Mon, 28 Sep 2020 13:13:08 GMT tprnc 2020-09-28T13:13:08Z https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106713#M22445 <P>For anyone who has used the snare agent - I've been testing snare agent for windows and snare server, and I've gotten the desired security event logs from the agent (- logins and specific file access) to the server. Then BLAM - the quote came in a lot higher than I expected. So I set up a splunk receiver, but the server running the agent doesn't show up as a source in Splunk Search. </P> <P>Free agent is udp only, so I've tried ports 514 and 6161, and tried source types of both windows_snare_syslog and plain old syslog. I have those ports open in the firewall on the splunk receiver. I've restarted the snare and splunk services.</P> <P>I know about the universal forwarder, but I'd really rather use the snare agent because it's already set to output only the info that I need.</P> <P>What am I missing in my setup? Thanks.</P> Mon, 28 Sep 2020 13:13:08 GMT https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106713#M22445 tprnc 2020-09-28T13:13:08Z https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106714#M22446 <P>Have you created an UDP input on port 514 on the Splunk indexer? Have you checked that you're actually receiving packets on port UDP/514?</P> Thu, 31 Jan 2013 19:29:56 GMT https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106714#M22446 Ayn 2013-01-31T19:29:56Z https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106715#M22447 <P>Thanks. Yes, I set a data input for UDP 514. It shows up in netstat, but the state is blank. </P> <P>I said earlier that my snare agent host isn't showing up as a source, but I meant it isn't showing up as a host.</P> <P>I have that port open in the firewall, but I just saw that a gpo may be blocking so I'm getting ready to check that.</P> Thu, 31 Jan 2013 20:50:25 GMT https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106715#M22447 tprnc 2013-01-31T20:50:25Z https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106716#M22448 <P>No problem with gpo, so I'm still not sure why 514 is getting no action.</P> Thu, 31 Jan 2013 21:18:30 GMT https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106716#M22448 tprnc 2013-01-31T21:18:30Z https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106717#M22449 <P>OK, so have you confirmed (using Wireshark or similar) that data is actually arriving on the port?</P> Thu, 31 Jan 2013 21:19:22 GMT https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106717#M22449 Ayn 2013-01-31T21:19:22Z https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106718#M22450 <P>I would also recommend sending syslog to a receiving host like a unix system. That way you collect using the splunk forwarder and if you ever have multiple indexers it can handle the load balancing. Sending straight syslog to a single indexer keeps you from having that option.</P> Thu, 07 Feb 2013 18:15:22 GMT https://community.splunk.com/t5/Getting-Data-In/Remote-snare-security-logs-to-splunk/m-p/106718#M22450 starcher 2013-02-07T18:15:22Z