All Apps and Add-ons

App for firewall traffic analysis

tsix
Engager

We like to consolidate logs of different firewall vendors with Splunk. Is there an app that allows searching for several fields (source, dest, port, proto, etc.), presents the results and implements drill down searches on theses results?

Thanks for your help.

0 Karma

tiagofbmm
Influencer

Hello

Yes it does exist, it is called Splunk Enterprise Security!

https://splunkbase.splunk.com/app/263/

0 Karma

tsix
Engager

Thanks for recommending ES. But we like to have something more targeted towards firewall operation. We are about to write a couple of dashboards that allow searching firewall traffic logs for blocked connections and analyze rule usage and such. I assume we are not the first having such a use case.

0 Karma

tiagofbmm
Influencer

If you are about to write the dashboard yourself, I would suggest you to take a look at the one of the DataModels in ES ann do it for your own use case.

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...