topic Re: Forwarding splunk'd logs to third party siem - McAfee ESM in Installation

Forwarding splunk'd logs to third party siem - McAfee ESM

MattQ — Tue, 23 Jul 2013 22:36:11 GMT

I am told it is very simple to take already indexed events from splunk and send them over to a 3rd party SIEM appliance like McAfee ESM.

Has anyone done this successfully? How hard was it to implement? Can you limit / forward only selected events? Can you limit forwarding to only select hosts or log types?

I have seen a few other similar questions and it seems INCREDIBLY simple, to the point of adding only a few lines of code to a few files. Is it really that easy?

Re: Forwarding splunk'd logs to third party siem - McAfee ESM

jtrucks — Thu, 25 Jul 2013 04:21:37 GMT

Use the REST or other API or the CLI to perform a search (scheduled or even real-time) and have the results sent to whatever API or file the other tool uses.

It's relatively simple, really, and you can do this with any search you want so you can send selective results to your other tool.

Re: Forwarding splunk'd logs to third party siem - McAfee ESM

dshpritz — Thu, 25 Jul 2013 12:54:15 GMT

You may also want to look at the Real-Time output app:

http://splunk-base.splunk.com/apps/48082/splunk-real-time-output

Re: Forwarding splunk'd logs to third party siem - McAfee ESM

sdaniels — Thu, 25 Jul 2013 13:12:23 GMT

You could also use a heavy forwarder and forward the data to McAfee via syslog at the same time as it sends it to your Splunk indexer. Of course this is before the data is indexed. This will also give you the flexibility to send a subset of the data. See the docs below:

http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Forwarddatatothird-partysystemsd

Re: Forwarding splunk'd logs to third party siem - McAfee ESM

mariogiovannitt — Tue, 01 Dec 2015 15:02:00 GMT

I configured the outputs.conf in my etc/local dir to forward AD logs from an indexer to a 3rd part SIEM . restarted, and still no joy. any ideas.

Re: Forwarding splunk'd logs to third party siem - McAfee ESM

kupawar — Wed, 17 May 2017 12:15:53 GMT

please refer any link or document.