Guieds

[hazem]

Is there any guide on how to configure security products to send their logs to Splunk or what are the recommended logs that should be sent, like the DSM guide in QRadar?

[gcusello · Accepted solution]

Hi @hazem ,

for many products there are some guides for integration with Splunk developed by the same third party vendor and the only way is to search on Google (e.g for Sophos you can see at https://partnernews.sophos.com/it-it/2021/05/prodotti/splunk-integration-for-sophos-firewall/).

Anyway, searching "Splunk Getting data in"  you have a guide to Datas ingestion in Splunk: https://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor  .

At least, the first approach to data ingestion should be identify the technology to ingest and searching the related Add-On in apps.splunk.com, that usually guides users to integration.

Ciao.

Giuseppe

[hazem]

Thank you @gcusello for your reply.

Our customer has asked me about the recommended log level that should be sent, for example, from Palo Alto to Splunk. Do you have any answer for this?"

[gcusello]

Hi @hazem ,

it depends on your Use cases: what do you want to monitor?

use a log level that gives you the data you need, I cannot say to you from outside what's the best log level.

In general, except some situations, I'd avoid the debug level and I'd use Alert level, but, as I said, it depends on your Use Cases.

In addition, this is a question for Palo Alto experts not Splunk because they know the contents of each log level.

Ciao.

Giuseppe

[hazem]

Hi @gcusello 

many thanks ,appreciate your support

[gcusello]

Hi @hazem ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉