All Apps and Add-ons

AWS Guardduty & Splunk

aknsun
Path Finder

Hi,

I have a requirement to get the AWS Guardduty working with Splunk. However I'm slightly confused on which method to pursue.

  • The pull approach which involves configuring services like Amazon Simple Notification Service (SNS) and Amazon Simple Queue Service (SQS) with a dead letter queue and installing and setting up the Splunk Add-on application that polls for the messages in an SQS queue.

OR

  • The push approach that uses Amazon CloudWatch events and Amazon Kinesis Data Firehose with the Splunk HEC

Hope someone can highlight the pros & cons of each approach.

Thanks,
AKN

0 Karma
1 Solution

amiracle
Splunk Employee
Splunk Employee

I've put together a document that might be able to help guide you on your decision between Push vs, Pull options, specific to AWS data sources . To quickly answer the question, it's going to depend on scale, cost, maintenance and latency of the data. If you're collecting from one account and it's relatively small amounts of data, then going the pull path would make sense. However, if you have multiple accounts collection large amounts of data, it might make sense to go down the path of Kinesis Firehose.

If you decide to go down the push path, I would recommend you look at the Project Trumpet blog for collecting that data (and help setting up the AWS components as well.)

(Edit Added the AWS GDI Doc/Whitepaper link.)

View solution in original post

amiracle
Splunk Employee
Splunk Employee

I've put together a document that might be able to help guide you on your decision between Push vs, Pull options, specific to AWS data sources . To quickly answer the question, it's going to depend on scale, cost, maintenance and latency of the data. If you're collecting from one account and it's relatively small amounts of data, then going the pull path would make sense. However, if you have multiple accounts collection large amounts of data, it might make sense to go down the path of Kinesis Firehose.

If you decide to go down the push path, I would recommend you look at the Project Trumpet blog for collecting that data (and help setting up the AWS components as well.)

(Edit Added the AWS GDI Doc/Whitepaper link.)

aknsun
Path Finder

@amiracle Thanks for the suggestions.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...