ArcSight and Splunk

[rakeshmukherjee]

Hi,

From you earlier post, I understand that you have integrated Splunk with ArcSight and so I would request if you please help me to understand a few question here,

What should be the SIEM architecture in a scenario where I have ArcSight Manager, Logger and connector and now I want to integrate Splunk for long term data retention purpose. I find that long term data retention is not a good cost effective option with ArcSight Logger and also searching performance is very slow in archived data since it does not contain index information. Also please send me the integration document between ArcSight and Splunk.

[mlulmer]

Have a look at this document. http://www.splunk.com/web_assets/pdfs/resources/Integrating_Splunk_with_Arcsight.pdf While this provides the basics, I believe that more in depth work would be needed to properly map the Windows audit logs.

[Ayn]

I think you've misunderstood the purpose of splunkbase. It is not a general forum for communicating requests to Splunk sales. It is a questions/answers sites where volunteers help out with issues and queries regarding designing, implementing and operating Splunk installations. As such, my suggestion is that you get in contact with Splunk sales.