All Apps and Add-ons

splunk kaspersky integration

ahmedhassanean
Explorer

Dears,

i have configured Kaspersky to send CEF log to Splunk destination from Kaspersky console but when I have used CEF add on to parse this data into Splunk it's not parsed correctly , so may I know how to get his data parsed and CIM compatabile for Splunk ES

Tags (1)
0 Karma

micahkemp
Champion

Please reference a recent answers post that may provide what you need.

ikulcsar
Communicator

Hi,

What do you mean by "not parsed correctly"?
I am also trying to get events to CIM compliant. I'm looking for documentation about Kaspersky Security Center log types...

Regards,
Istvan

0 Karma

ahmedhassanean
Explorer

i mean data is parsed by no keys populated to this values , the values must be parsed with CIM compliant values

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...