topic Re: BeyondTrust Retina logs through Splunk HTTP Event Collector in Getting Data In

BeyondTrust Retina logs through Splunk HTTP Event Collector

sshres5 — Mon, 05 Jun 2017 20:51:22 GMT

I am trying to on board Retina logs through HTTP Event Collector, however I am not having any luck on it.

Firewall has been opened, and I can see it being allowed, but it is not reaching the HEC.
We can see the below error when we try
SplunkClient.SendApiRequest failed with error 'The remote server returned an error:(404) Not Found'.

Not sure where the issue is, we have tried couple of different end points. However, I can use curl to send data. Has anyone on boarded data through HTTP Event Collector for BeyondTrust Retina?

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

j0shrice — Tue, 25 Jul 2017 18:08:39 GMT

Has there been any update on this?

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

sshres5 — Tue, 25 Jul 2017 18:14:45 GMT

Yeah we finally got it working. It was firewall issue.

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

j0shrice — Tue, 25 Jul 2017 18:16:22 GMT

How did you configure BeyondTrust to send via the HTTP Event Collector?

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

j0shrice — Tue, 25 Jul 2017 18:20:20 GMT

Or do you have a link to any documentation?

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

sshres5 — Tue, 25 Jul 2017 18:32:15 GMT

Well, I don't own Beyond Trust application. However, they provided me access to console to troubleshoot. I just needed to add the following on the configuration page of BT
Host Name:
Port:
Splunk Index:
Splunk Sourcetype:
Splunk Source:

Then at the bottom they had a panel to checkmark what to send or something similar

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

j0shrice — Tue, 25 Jul 2017 18:42:24 GMT

Ahh, yeah I don't see the configuration page on BT. Unless you are referring to Tools-->Alerting-->Actions, but that doesnt have anything Splunk related other than the host value to send to

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

sshres5 — Tue, 25 Jul 2017 19:05:57 GMT

No. It was under Configure -> Connectors

Do you have that options? I got access through the webpage, not the actual console

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

j0shrice — Tue, 25 Jul 2017 19:52:45 GMT

I believe we are on an older version, working to get it updated now. Are you using a TA for the props / transforms or just built your extractions custom?

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

sshres5 — Tue, 25 Jul 2017 20:58:53 GMT

I don't have any props or transforms as of now.

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

j0shrice — Fri, 28 Jul 2017 03:47:44 GMT

I believe since the data does not come through raw, it is considered already "cooked" and no index-time extractions can be applied. We are missing a severity field as well as the timestamp being 4 hours off. This is using the Splunk HEC connector. We might have to default back to syslog! Thanks for the help!

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

sshres5 — Fri, 28 Jul 2017 16:15:51 GMT

Yeah time is off. Haven't had time to do a research on how to fix it. Props doesn't work either.

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

sshres5 — Fri, 28 Jul 2017 16:18:56 GMT

But one thing I noticed was test didn't have issues as the logs didn't have any time on it. So it took indexing time. But the real logs have time, and gets screwed.

Re: BeyondTrust Retina logs through Splunk HTTP Event Collector

j0shrice — Tue, 08 Aug 2017 14:12:39 GMT

I Agree. Have had similar issues