All Apps and Add-ons

CyberArk Log format coming into Splunk

abheeks
New Member

Hi All,

We are trying to ingest the cyberark data into Splunk. CyberArk is sending logs into a syslog server from where we have tried to ingest into Splunk. But the logs are coming into the syslog server where we find the below issue of getting square braces like below .

|Backup[Metadata|5|act="Backup]
Prepare[Backup] Backup Metadata"
Monitor[FW] end|5|act="Monitor FW Rules end"
Retrieve[File|5|act="Retrieve]

Due to this the field "cef_name" is coming as below

Backup[Metadata

Retrieve[File
Monitor[FW

So please let me know if the above format is correct and accepted? If not then we will check in the CyberArk if there is an issue in the log format.

Regards,
Abheek

0 Karma

nickhills
Ultra Champion

Hi Abheek,

In CyberArk you can load an xsl document which configures the CEF format to an appropriate type.
If you are planning on using the CyberArk TA, the TA comes with a file named SplunkCIM.xsl which will allow the TA to normalise your events into the CIM compliant format.

It seems possible you may have a different xsl file loaded which is amending the log format CyberArk is sending.

With it configured correctly, your CyberArk logs should look like this in Splunk. [REDACTED]

Jan 12 12:56:42 IP.IP.IP.IP 1 2018-01-12T12:56:42Z HOSTNAME CEF:0|Cyber-Ark|Vault|VERSION|106|Update File Category|5|act="Update File Category" suser=USERNAME fname=Root\268\CyberArk.Reports.xml dvc= shost=HOSTIP dhost= duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2="SAFENAME" cs3Label="Device Type" cs3= cs4Label="Database" cs4= cs5Label="Other info" cs5="ReportFailureReason" cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=  msg=

http://docs.splunk.com/Documentation/AddOns/released/CyberArk/Setup#Configure_EPV_to_produce_syslog

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...