All Apps and Add-ons

Tripwire App

julian0125
Explorer

Hello Splunkers

How can i see logs from tripwire on Splunk using Syslog port 514?

0 Karma

JimWachhaus
Path Finder

Tripwire Enterprise (TE) has at least 3 means of providing syslog:

  1. A syslog action is UDP/514 and can be configured for different syslog receivers. This will provide change information, file that changed, how it changed, what rule was used, and what system the change occurred on.
  2. Log Management is TCP/1468 and provides logs of everything on the TE console including changes to configuration, logons, and audit events from the agents.
  3. TE Event Sender is a utility added to a TE install to provide granular logging over TCP or UDP syslog on various events not included with the action or log management.

What option are we discussing?

0 Karma

julian0125
Explorer

hi @JimWachhaus
We have installed Tripwire Add - on for Splunk i configured it as syslog 514 udp, but how can we confirm that there is a conection between the tripwire and splunk? i sent data (logs) from tripwire to splunk but i was unable to see the information.

0 Karma

JimWachhaus
Path Finder

The Add-On defaults to TE Log Management which is TCP syslog on port 1468. How did you send logs?

0 Karma

julian0125
Explorer

i log into tripwire and there is an option to send any message like warnings etc. So i suppose that sending a message the splunk can recieve it

0 Karma

JimWachhaus
Path Finder

After you log in what steps did you take to navigate to that?

Was it under settings or actions?

0 Karma

julian0125
Explorer

i just logged into tripwire console web and in message>send to syslog

0 Karma

JimWachhaus
Path Finder

What product and version are you using?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!