topic RSA Archer Splunk Integration in Monitoring Splunk

RSA Archer Splunk Integration

azharuddin1 — Fri, 18 Aug 2017 11:06:53 GMT

I'm currently working as an archer engineer on an RSA Archer deployment at a government agency, and I am soliciting any informational knowledge regarding an integration between RSA Archer (V.5.4) and probably the latest version of splunk. Ideally, I would like to have a data feed from splunk feeding into the archer platform to allow our client to have meaningful data regarding enterprise assets and other components that are spread-out around the network. I look forward to you responses.
Regards,

Re: RSA Archer Splunk Integration

richgalloway — Fri, 18 Aug 2017 13:11:04 GMT

Your agency's CDM provider should have a solution for this.

I'm aware of two solutions, although there may be others.

The first is have Archer make ODBC calls to Splunk for data. Each call will map to a Splunk saved search that collects the desired data.

The other is to schedule saved searches to collect data and write it to a file. Use cron (or something similar) to copy the file to a location Archer monitors.

Re: RSA Archer Splunk Integration

robjackson — Thu, 17 Sep 2020 20:44:39 GMT

He asked for the other way. Archer data to Splunk. Not Splunk to Archer