Archive

App for firewall traffic analysis

Engager

We like to consolidate logs of different firewall vendors with Splunk. Is there an app that allows searching for several fields (source, dest, port, proto, etc.), presents the results and implements drill down searches on theses results?

Thanks for your help.

0 Karma

Influencer

Hello

Yes it does exist, it is called Splunk Enterprise Security!

https://splunkbase.splunk.com/app/263/

0 Karma

Engager

Thanks for recommending ES. But we like to have something more targeted towards firewall operation. We are about to write a couple of dashboards that allow searching firewall traffic logs for blocked connections and analyze rule usage and such. I assume we are not the first having such a use case.

0 Karma

Influencer

If you are about to write the dashboard yourself, I would suggest you to take a look at the one of the DataModels in ES ann do it for your own use case.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!