topic How to stop ingesting from 1 of 4 firewalls? in Splunk Enterprise Security

How to stop ingesting from 1 of 4 firewalls?

sandyvaldez — Fri, 11 Mar 2022 15:30:04 GMT

I need to stop ingesting from 1 of 4 of my firewalls.

The path of our architecture is firewalls >>>syslog>>>>deployment server>>indexer cluster>>>>search head

I have tried commenting them out under deployment apps (inputs.conf ) in the deployment server, but I am still seeing ingestion from that firewall.

Any help is appreciated!

Re: How to stop ingesting from 1 of 4 firewalls?

venky1544 — Fri, 11 Mar 2022 16:02:27 GMT

@sandyvaldez

are you sure its syslog >>deployment server

usually its syslog>> HF >>indexer cluster

i guess you are missing a HF component and its where you were probably should be looking

Re: How to stop ingesting from 1 of 4 firewalls?

sandyvaldez — Mon, 14 Mar 2022 15:57:19 GMT

Hi and Thanks for your insight. See below.

This is the exact architecture. This was created before I came onboard. Do you know where I would need to remove or comment out this firewall?

Re: How to stop ingesting from 1 of 4 firewalls?

somesoni2 — Fri, 11 Mar 2022 20:38:43 GMT

If your firewalls are sending data to Splunk via syslog (which means Splunk is "receiving" the data from firewall and not "pulling/fetching" it), then best way would be to turn off syslog sending on the firewall appliance from which you don't want data to come.

Other option would be to "ignore" the incoming data from that 1 firewall. (I would go this route if I can't do first approach). You'll have to look at your Syslog server (splunklogs01) and find the data input which is monitoring syslog data files from that firewall and find a way to turn it off (either commenting the monitoring of that firewall related file if there is a separate file monitoring setup for each firewall OR adding blacklist attribute if a single monitoring stanza is used).

If they all log into same log file, then you'd have to filter the data and drop those events from being indexed. This filtering would be setup on your indexers. You can find filtering configurations here: https://docs.splunk.com/Documentation/Splunk/8.2.5/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues