All Apps and Add-ons

After collecting Cloudtrail data with the Splunk App for AWS, how do we forward this data to ArcSight?

vhdevera
New Member

Hi,

We have a test setup for Splunk enterprise (in single instance) to receive Cloudtrail and was able to fulfill this using Splunk App for AWS. Now we would like to to send the collected data from Splunk into Arcsight. I read that we can do that by using Splunk forwarders, but not certain on what type of forwarder to use (like heavy, enterprise or universal...). Basicall, we want to send all collected data, be it in CEF or unparsed. What is the best path to do this, and can you point me to some documentation?

Thanks in advance

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

Take a look at the Splunk App for CEF:

https://splunkbase.splunk.com/app/1847/#/overview
http://docs.splunk.com/Documentation/CEFapp/1.0.0/DeployCEFapp/UsetheSplunkAppforCEF

From the documentation you can do the CEF Mappings then define the output to send to your ArcSight instance.

0 Karma

vhdevera
New Member

Hi dcharboneau_splunk,

Appreciate your response.
I am also looking at http://www.splunk.com/web_assets/pdfs/resources/Integrating_Splunk_with_Arcsight.pdf for overview but so far I have not seen detailed configuration on how to do this. Wondering if you know any document that discuss or show how to do it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...