All Apps and Add-ons
Highlighted

After collecting Cloudtrail data with the Splunk App for AWS, how do we forward this data to ArcSight?

New Member

Hi,

We have a test setup for Splunk enterprise (in single instance) to receive Cloudtrail and was able to fulfill this using Splunk App for AWS. Now we would like to to send the collected data from Splunk into Arcsight. I read that we can do that by using Splunk forwarders, but not certain on what type of forwarder to use (like heavy, enterprise or universal...). Basicall, we want to send all collected data, be it in CEF or unparsed. What is the best path to do this, and can you point me to some documentation?

Thanks in advance

0 Karma
Highlighted

Re: After collecting Cloudtrail data with the Splunk App for AWS, how do we forward this data to ArcSight?

Splunk Employee
Splunk Employee

Take a look at the Splunk App for CEF:

https://splunkbase.splunk.com/app/1847/#/overview
http://docs.splunk.com/Documentation/CEFapp/1.0.0/DeployCEFapp/UsetheSplunkAppforCEF

From the documentation you can do the CEF Mappings then define the output to send to your ArcSight instance.

0 Karma
Highlighted

Re: After collecting Cloudtrail data with the Splunk App for AWS, how do we forward this data to ArcSight?

New Member

Hi dcharboneau_splunk,

Appreciate your response.
I am also looking at http://www.splunk.com/web_assets/pdfs/resources/Integrating_Splunk_with_Arcsight.pdf for overview but so far I have not seen detailed configuration on how to do this. Wondering if you know any document that discuss or show how to do it.

0 Karma