how to input encrypted files like PGP encrypted files

VSIRIS — Mon, 29 Jun 2020 15:22:48 GMT

Hello Everyone,

Does anyone know if there is any method in Splunk to index encrypted input files like PGP encrypted files.

Re: how to input encrypted files like PGP encrypted files

ashish9433 — Mon, 29 Jun 2020 16:53:09 GMT

Hey,

There is no direct way of onboarding encrypted data to Splunk. In case there is a requirement to do so, you can go ahead and write a script (python/shell) that access the API of encrypted source, parse it and send it to Splunk.

There is a python library to address this

https://pypi.org/project/py-pgp/

The below code should be a starter for you

import pgpy emsg = pgpy.PGPMessage.from_file(<path to the file from the client that was encrypted using your public key>) key,_ = pgpy.PGPKey.from_file(<path to your private key>) with key.unlock(<your private key passpharase>): print (key.decrypt(emsg).message)

topic Re: how to input encrypted files like PGP encrypted files in Getting Data In

how to input encrypted files like PGP encrypted files

Re: how to input encrypted files like PGP encrypted files