Integration between Traps In cloud and splunk enterprise

[aalhabbash1]

We want to integration between splunk enterprise and traps cloud.

Traps will use port (tls 6514) for send logs to splunk and this require wildcard certificate, how can I upload wildcard certificate to syslog server (universal forwarder server), you can see the following url from traps team to integrate.

https://docs.paloaltonetworks.com/cloud-services/apps/log-forwarding/log-forwarding-app-getting-star...

https://docs.paloaltonetworks.com/cloud-services/apps/log-forwarding/log-forwarding-app-getting-star...

And when I do configuration on rsyslog.conf file I do configuration as the following:

for port udp send to splunk:

$RuleSet remoteudp1514
$RulesetCreateMainQueue on # create ruleset-specific queue

$template SyslogPaloAltoHQUDP1514,"/data/syslog/security/paloalto/hq/%fromhost-ip%/Kaspersky_syslog.log"
. -?SyslogPaloAltoHQUDP1514

$InputUDPServerBindRuleset remoteudp1514
$UDPServerRun 1514
$PrivDropToUser splunk

and for TCP send to splunk:

$RuleSet remotetcp1514
$RulesetCreateMainQueue on # create ruleset-specific queue

$template SyslogPaloAltoHQTCP1514,"/data/syslog/security/paloalto/hq/%fromhost-ip%/PA_syslog.log"
. -?SyslogPaloAltoHQTCP1514

$InputTCPServerBindRuleset remotetcp1514
$InputTCPServerRun 1514
$PrivDropToUser splunk

If I need receive logs from TLS 6514, how do for this port configuration on rsyslog.conf file?

[btorresgil]

From the Palo Alto Networks perspective, it will send the log to any syslog server that presents a trusted server certificate. From the Splunk perspective, the Universal Forwarder will index any logs collected by rsyslog. So it sounds like this question is rsyslog focused. Perhaps one of the "Configure TLS on rsyslog" guides around the internet might help? http://kb.kristianreese.com/index.php?View=entry&EntryID=148 https://www.loggly.com/docs/rsyslog-tls-configuration/