All Apps and Add-ons

Integration between Traps In cloud and splunk enterprise

aalhabbash1
Path Finder

We want to integration between splunk enterprise and traps cloud.

Traps will use port (tls 6514) for send logs to splunk and this require wildcard certificate, how can I upload wildcard certificate to syslog server (universal forwarder server), you can see the following url from traps team to integrate.

https://docs.paloaltonetworks.com/cloud-services/apps/log-forwarding/log-forwarding-app-getting-star...

https://docs.paloaltonetworks.com/cloud-services/apps/log-forwarding/log-forwarding-app-getting-star...

And when I do configuration on rsyslog.conf file I do configuration as the following:

for port udp send to splunk:

$RuleSet remoteudp1514
$RulesetCreateMainQueue on # create ruleset-specific queue

$template SyslogPaloAltoHQUDP1514,"/data/syslog/security/paloalto/hq/%fromhost-ip%/Kaspersky_syslog.log"
. -?SyslogPaloAltoHQUDP1514

$InputUDPServerBindRuleset remoteudp1514
$UDPServerRun 1514
$PrivDropToUser splunk

and for TCP send to splunk:

$RuleSet remotetcp1514
$RulesetCreateMainQueue on # create ruleset-specific queue

$template SyslogPaloAltoHQTCP1514,"/data/syslog/security/paloalto/hq/%fromhost-ip%/PA_syslog.log"
. -?SyslogPaloAltoHQTCP1514

$InputTCPServerBindRuleset remotetcp1514
$InputTCPServerRun 1514
$PrivDropToUser splunk

If I need receive logs from TLS 6514, how do for this port configuration on rsyslog.conf file?

0 Karma

btorresgil
Builder

From the Palo Alto Networks perspective, it will send the log to any syslog server that presents a trusted server certificate. From the Splunk perspective, the Universal Forwarder will index any logs collected by rsyslog. So it sounds like this question is rsyslog focused. Perhaps one of the "Configure TLS on rsyslog" guides around the internet might help? http://kb.kristianreese.com/index.php?View=entry&EntryID=148 https://www.loggly.com/docs/rsyslog-tls-configuration/

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...