The splunkbase app got this details:(i am not sure if there are any other documentations available for this app)
https://splunkbase.splunk.com/app/4204/#/details
Documentation:
Refer to the Admin Guide from your Entrust Datacard IntelliTrust account for assistance.
Configuration:
Before configuring the add-on, customers must create a Splunk application prior to this step. See the IntelliTrust Admin Online Help for more information.
To configure your add-on, complete the following steps after downloading and installing the add-on:
- Create a new input for your IntelliTrust source.
- Select the category of logs you would like to import from IntelliTrust into Splunk. The categories are:
a. Authentication Events
b. Management Events
c. Both (By default both categories are selected)
- Enter the interval (in seconds) to set the frequency that audit logs in IntelliTrust are imported into Splunk. The interval cannot be less than 30 seconds.
The first time the add-on is enabled, all events are imported into Splunk. After that, events are imported at the set interval rate.
- Under Configuration > Add-on Settings enter the json value that was created when you added a Splunk application in IntelliTrust.
Upon successful configuration, this add-on will automatically import all previously logged audits for the specified category into Splunk.
Once the data source is enabled and data is being pulled in, administrators can create dashboards with IntelliTrust audit data.
As you are a new user to Splunk Answers, you can upvote the answers/comments,
if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!
