All Apps and Add-ons

Kaspersky ingestion not showing logs

schalkrust
Engager

I have set up the Kasperky forwarding on the console and have granted all required firewall access to the logs,
but I still can't see any logs coming into Splunk indexer.

0 Karma

markelovi
New Member

Hello @schalkrust,

Could you please clarify your question. What logs did you mean? From which application - Kaspersky Security Center?
I want to clarify this, because the application (https://splunkbase.splunk.com/app/3774) about which you asking, does not work with logs directly, but allows you to access our cloud-based reputation service (TI-Portal).
Thank you.

Ilya Markelov | Product Manager | Threat Management and Defense | Kaspersky

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @schalkrust,
which kind of Kaspersky logs are you ingesting: syslogs or wineventlogs?
Kaspersky stores logs in both these ways, but on wineventlog is more complete: for an our customer, we decided to stop syslogs ingestion becasuse we had all we needed from wineventlog.

To ingest Kaspersky logs from wineventlogs (a different one than security or application) you have to create an inputs.con like this on your Universal Forwarder on Kaspersky server:

[WinEventLog://Kaspersky Event Log]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = kaspersky
renderXml = false

Ciao.
Giuseppe

0 Karma

techiesid
SplunkTrust
SplunkTrust

Hi,

Can you try to see in internal index whether any error is showing up?

index=_internal kaspersky 

Sid

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...