All Apps and Add-ons

After collecting Cloudtrail data with the Splunk App for AWS, how do we forward this data to ArcSight?

vhdevera
New Member

Hi,

We have a test setup for Splunk enterprise (in single instance) to receive Cloudtrail and was able to fulfill this using Splunk App for AWS. Now we would like to to send the collected data from Splunk into Arcsight. I read that we can do that by using Splunk forwarders, but not certain on what type of forwarder to use (like heavy, enterprise or universal...). Basicall, we want to send all collected data, be it in CEF or unparsed. What is the best path to do this, and can you point me to some documentation?

Thanks in advance

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

Take a look at the Splunk App for CEF:

https://splunkbase.splunk.com/app/1847/#/overview
http://docs.splunk.com/Documentation/CEFapp/1.0.0/DeployCEFapp/UsetheSplunkAppforCEF

From the documentation you can do the CEF Mappings then define the output to send to your ArcSight instance.

0 Karma

vhdevera
New Member

Hi dcharboneau_splunk,

Appreciate your response.
I am also looking at http://www.splunk.com/web_assets/pdfs/resources/Integrating_Splunk_with_Arcsight.pdf for overview but so far I have not seen detailed configuration on how to do this. Wondering if you know any document that discuss or show how to do it.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!