All Apps and Add-ons

How to parse Trend Micro Deep Security Log Inspection in XML?

alaquerre
Explorer

Hi everyone,

So in the past our customer was using a combination of Splunk and Ossec agents and that worked splendidly (to it's limit anyway) and now they have installed Deep Security package in order to use the OSSEC feature and collect Windows logs instead of the Splunk agent so as to avoid having multiple agents installed across the infrastructure. The Solution was to forward all of the logs towards a single Splunk Agent that will then collect and send to the Splunk Server. Now the logs are all coming in beautifully except for the format of the windows logs that are no longer being sent in XML format (as was the case with the Splunk Agent) which is now a bit of an issue for all of our dashboards that relied on that type of Parsing. Does anyone have any suggestions on how i could parse those logs coming from the Log Inspection in the same was as the Splunk Forwarder would ?

Thanks 😃

Alexandre,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...