Sentinal Logs to Splunk Enterprise

[rahulkumar]

Hello 

I just want to know if I have Sentinel logs forwarded to Splunk via HEC directly. Is there any other way to get these logs? I am given the Sentinel logs directly in Splunk and have no access to Azure. I do not want to use HEC because of the huge amount of unfiltered data. Is there any way to resolve this issue or can I ask the Azure team to do something that gives me filtered data, even if I have to use HEC in the end? Sentinel 

[kiran_panchavat]

@rahulkumar 

Instead of HEC, the Azure team can configure Sentinel to stream logs to an Azure Event Hub, which Splunk can then pull using the Splunk Add-on for Microsoft Cloud Services or a custom Azure Function.

https://lantern.splunk.com/Data_Descriptors/Microsoft/Getting_started_with_Microsoft_Azure_Event_Hub...

https://www.splunk.com/en_us/blog/platform/splunking-azure-event-hubs.html 

https://splunkbase.splunk.com/app/3110 

[rahulkumar]

Hi @kiran_panchavat  thanks for replying 

the concern is using the Splunk Add-on for Microsoft Cloud Services in splunk enterprise needs azure side configurations as well I think and I will be having no access to it as its client side and they will just provide us with the data only ? is it possible you can clear my doubt about add on services using azure config as well

[kiran_panchavat]

@rahulkumar 

If the client is willing to set up the Azure AD application and provide you with the necessary credentials (Client ID, Client Secret, Tenant ID, Workspace ID, etc.), you can configure the Splunk Add-on to pull logs from the Log Analytics workspace, Event Hub, or Blob Storage without needing direct Azure access.

[rahulkumar]

Thanks @kiran_panchavat  it helped alot I can look into this. 
but if client denies for the azure credentials which have high chances ..! is there any other way also to do this ?

[kiran_panchavat]

@rahulkumar 

Since the client is pushing Sentinel logs to your Splunk HEC endpoint, you can filter out unwanted events within Splunk to reduce the indexed data volume, using a null queue to discard events before they’re indexed. 

Configure Splunk’s props.conf and transforms.conf on your heavy forwarder to route unwanted events to a null queue, preventing them from consuming your Splunk license.

https://docs.splunk.com/Documentation/Splunk/9.4.2/Forwarding/Routeandfilterdatad 

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data...