topic Re: Splunk and QRadar integration in Splunk Search

Splunk and QRadar integration

andrey2007 — Fri, 26 Jul 2013 07:12:31 GMT

Hello,
I am interested in examples of integration of Splunk as data source to QRadar.
May be somebody has any? What kind of data, in what format and what way have you sent to Qradar?
Is it a complicated process?

Thanks for any advice!

Re: Splunk and QRadar integration

jaoui — Tue, 20 Aug 2013 18:46:17 GMT

any luck on this one?

Re: Splunk and QRadar integration

andrey2007 — Wed, 21 Aug 2013 06:53:01 GMT

to my sorry, no(

Re: Splunk and QRadar integration

sbrant_splunk — Wed, 21 Aug 2013 07:24:41 GMT

This depends on what sort of integration you have in mind. If you simply would like to forward data from Splunk to QRadar, then you have a number of options.

I'm not familiar with QRadar's method of data ingestion but I suspect it accepts syslog data, so that would be one (probably the easiest) option. There are a number of ways to send the syslog. It could be cloned and sent at the same time that Splunk indexes it, raw. You could also setup a real-time search and send (as syslog) the results of the search, using the Splunk Real-Time Output app.

Re: Splunk and QRadar integration

andrey2007 — Wed, 21 Aug 2013 07:38:22 GMT

Certainly now your answer is the most complete but i am interesting in use cases. As i know Qradar and splunk ES are quite equal products(SIEMs) and have the same reports. That is why it is interesting for me to know is any profit from such kind of integration.

Re: Splunk and QRadar integration

sbrant_splunk — Wed, 21 Aug 2013 15:13:28 GMT

Whether or not there is benefit in integrating, primarily has to do with how vested you are in the use of qradar but also in how you want to use your data. The possibility for use cases, beyond what qradar can reasonably handle, is huge in Splunk. Of course, I'm speaking of the core capabilities of Splunk and not just ES.

Splunk is a platform and it does not require that your data be fully parsed when it is indexed, so unlike database driven SIEMs, data can be parsed at search-time, to accommodate different use cases. In addition, data not relevant in a SIEM can be utilized in Splunk.

Re: Splunk and QRadar integration

kefoster — Wed, 27 Jul 2016 14:33:34 GMT

I downvoted this post because app is no longer there

Re: Splunk and QRadar integration

sbrant_splunk — Thu, 28 Jul 2016 15:13:24 GMT

As stated, the Splunk real-time output app is no longer available. Here is the official guidance for forwarding data to another system: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd