All Apps and Add-ons

AWS Guardduty & Splunk

aknsun
Path Finder

Hi,

I have a requirement to get the AWS Guardduty working with Splunk. However I'm slightly confused on which method to pursue.

  • The pull approach which involves configuring services like Amazon Simple Notification Service (SNS) and Amazon Simple Queue Service (SQS) with a dead letter queue and installing and setting up the Splunk Add-on application that polls for the messages in an SQS queue.

OR

  • The push approach that uses Amazon CloudWatch events and Amazon Kinesis Data Firehose with the Splunk HEC

Hope someone can highlight the pros & cons of each approach.

Thanks,
AKN

0 Karma
1 Solution

amiracle
Splunk Employee
Splunk Employee

I've put together a document that might be able to help guide you on your decision between Push vs, Pull options, specific to AWS data sources . To quickly answer the question, it's going to depend on scale, cost, maintenance and latency of the data. If you're collecting from one account and it's relatively small amounts of data, then going the pull path would make sense. However, if you have multiple accounts collection large amounts of data, it might make sense to go down the path of Kinesis Firehose.

If you decide to go down the push path, I would recommend you look at the Project Trumpet blog for collecting that data (and help setting up the AWS components as well.)

(Edit Added the AWS GDI Doc/Whitepaper link.)

View solution in original post

amiracle
Splunk Employee
Splunk Employee

I've put together a document that might be able to help guide you on your decision between Push vs, Pull options, specific to AWS data sources . To quickly answer the question, it's going to depend on scale, cost, maintenance and latency of the data. If you're collecting from one account and it's relatively small amounts of data, then going the pull path would make sense. However, if you have multiple accounts collection large amounts of data, it might make sense to go down the path of Kinesis Firehose.

If you decide to go down the push path, I would recommend you look at the Project Trumpet blog for collecting that data (and help setting up the AWS components as well.)

(Edit Added the AWS GDI Doc/Whitepaper link.)

aknsun
Path Finder

@amiracle Thanks for the suggestions.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...