Kaspersky ingestion not showing logs

[schalkrust]

I have set up the Kasperky forwarding on the console and have granted all required firewall access to the logs,
but I still can't see any logs coming into Splunk indexer.

[markelovi]

Hello @schalkrust,

Could you please clarify your question. What logs did you mean? From which application - Kaspersky Security Center?
I want to clarify this, because the application (https://splunkbase.splunk.com/app/3774) about which you asking, does not work with logs directly, but allows you to access our cloud-based reputation service (TI-Portal).
Thank you.

Ilya Markelov | Product Manager | Threat Management and Defense | Kaspersky

[gcusello]

Hi @schalkrust,
which kind of Kaspersky logs are you ingesting: syslogs or wineventlogs?
Kaspersky stores logs in both these ways, but on wineventlog is more complete: for an our customer, we decided to stop syslogs ingestion becasuse we had all we needed from wineventlog.

To ingest Kaspersky logs from wineventlogs (a different one than security or application) you have to create an inputs.con like this on your Universal Forwarder on Kaspersky server:

[WinEventLog://Kaspersky Event Log]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = kaspersky
renderXml = false

Ciao.
Giuseppe

[techiesid]

Hi,

Can you try to see in internal index whether any error is showing up?

index=_internal kaspersky 

Sid