Archive

How to import cef data from data source in splunk enterprise without an agent?

New Member

I tried many times to import raw data (CEF) from another SIEM (just to test) and configured to send data to a specific port with zero results.
Any ideas on what is the correct procedure to do this?
Thanks

0 Karma

SplunkTrust
SplunkTrust

you can take data directly from CEF to splunk, there is also an app for it:
https://splunkbase.splunk.com/app/1847/#/overview
installation and configuration here:
http://docs.splunk.com/Documentation/CEFapp/2.0.1/DeployCEFapp/AboutSplunkAppforCEF
what is the other SIEM tool?

0 Karma