All Apps and Add-ons

Is it possible to use only one listener for the Trend Micro Deep Security for Splunk app (by limiting sourcetypes)?

New Member

I know 'Trend Micro Deep Security for Splunk' app by default creates 6 listeners each listening at unique UDP ports. And, this is to classify/separate events based on the source.
Is there a way we can only use one UDP port to listen to events. So, can we use one sourcetype 'deepsecurity' instead of multiple sub sourcetypes like: deepsecurity-antimalware, deepsecurity-web_reputation etc?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Yes you can. I do it using a syslog server between Splunk and TMDS.

We send syslog from TMDS in cef format to a syslog server and ingest the data into Splunk as sourcetype = deepsecurity:cef

So theoretically you could send the CEF data directly to Splunk and listen on one port with sourcetype=deepsecurity:cef

View solution in original post

SplunkTrust
SplunkTrust

Yes you can. I do it using a syslog server between Splunk and TMDS.

We send syslog from TMDS in cef format to a syslog server and ingest the data into Splunk as sourcetype = deepsecurity:cef

So theoretically you could send the CEF data directly to Splunk and listen on one port with sourcetype=deepsecurity:cef

View solution in original post

New Member

Does the trendmicro app for Splunk work with sourcetype = deepsecurity:cef

0 Karma

SplunkTrust
SplunkTrust

Not 100%. Maybe it's just sourcetype=deepsecurity

0 Karma

SplunkTrust
SplunkTrust

Check out what's in the TA in props.conf

0 Karma

Contributor

Same here

0 Karma

New Member

This sounds very feasible. Thanks for your answer.

0 Karma