All Apps and Add-ons

Splunk and Pfsense

grantfarms
New Member

I have pfsense dumping syslog to my splunk server. I'm not sure why but my snort app within splunk does not show any data. A search on my internal default gateway reveals a lot of information. Not sure how to search on it to help me out.

Tags (1)
0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Splunk for Snort expects full alert logs to have a sourcetype of "snort_alert_full" and fast alert logs to have a sourcetype of "snort_alert_fast". Note that you don't need both types, any one will do - these distinctions are only there to make sure that Splunk parses the logs correctly. Sourcetypes are renamed to "snort" at search time, so if you do have both full and fast logs you won't need to worry about searching separately for each corresponding sourcetype.

gimmemoredata
New Member

I have the same issue. PFSense and Snort all in the same pfsense index. Im assuming I have to install the forwarder on my pfsense box to forward those logs, and not dump the snort logs into syslog.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...