All Apps and Add-ons

Looking for RedHat app and add-on recomendations.

Svill321
Path Finder

Hello,

We are going to import RedHat web logs into Splunk for security monitoring. I was just wondering if anyone had any recommendations, based on your own experience, on apps I can use to make this process easier. So far, I've looked at Linux Auditd, Splunk App for Unix and Linux, and Red Hat Storage App for Splunk Enterprise (which I don't think fits my purposes). I just wanted to get other people's opinions on these apps, as well as hear any suggestions you have for alternatives.

If it matters, we are going to be using the logs for security, particularly in regards to detecting brute force attacks and privilege escalation.

Thank you.

0 Karma
1 Solution

klaxdal
Contributor

NMON for Splunk along with Auditd is a fav of mine for all *NIX variants also Fail2Ban if your going that route on your Linux hosts .

View solution in original post

klaxdal
Contributor

NMON for Splunk along with Auditd is a fav of mine for all *NIX variants also Fail2Ban if your going that route on your Linux hosts .

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...