Tripwire App

[julian0125]

Hello Splunkers

How can i see logs from tripwire on Splunk using Syslog port 514?

[JimWachhaus]

Tripwire Enterprise (TE) has at least 3 means of providing syslog:

1. A syslog action is UDP/514 and can be configured for different syslog receivers. This will provide change information, file that changed, how it changed, what rule was used, and what system the change occurred on.
2. Log Management is TCP/1468 and provides logs of everything on the TE console including changes to configuration, logons, and audit events from the agents.
3. TE Event Sender is a utility added to a TE install to provide granular logging over TCP or UDP syslog on various events not included with the action or log management.

What option are we discussing?

[julian0125]

hi @JimWachhaus
We have installed Tripwire Add - on for Splunk i configured it as syslog 514 udp, but how can we confirm that there is a conection between the tripwire and splunk? i sent data (logs) from tripwire to splunk but i was unable to see the information.

[JimWachhaus]

The Add-On defaults to TE Log Management which is TCP syslog on port 1468. How did you send logs?

[julian0125]

i log into tripwire and there is an option to send any message like warnings etc. So i suppose that sending a message the splunk can recieve it

[JimWachhaus]

After you log in what steps did you take to navigate to that?

Was it under settings or actions?

[julian0125]

i just logged into tripwire console web and in message>send to syslog

[JimWachhaus]

What product and version are you using?