Are there currently supported methods for ingesting and monitoring Suricata events in Splunk?

[opoplawski]

Are there currently supported methods for ingesting and monitoring Suricata events in splunk?

[richgalloway]

There is an old TA on splunkbase (https://splunkbase.splunk.com/app/4242).  Perhaps it will help.

If not, there are a few ways to onboard data into Splunk.

Install a universal forwarder on the server to send log files to Splunk
Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
Use the server's API to extract data for indexing
Use Splunk DB Connect to pull data from the server's SQL database.
Have the application send data directly to Splunk using HTTP Event Collector (HEC).

What you mean by "supported"?  The TA is unsupported.  The onboarding methods are standard in Splunk, but Splunk Support will not help you with them as they are break/fix only.

[opoplawski]

I'm suspicious of the old TA for Suricata because it mentions splunk 7.2 and CIM 4.x, but I'll guess I'll test it out.

I guess I'm looking for "useful" more than anything else.  Something that will display the events in a useful way.

---

[richgalloway]

The old TA can be used as a guide to create your own TA that is more up-to-date.

Neither TA will display events as they only help onboard them.  For display purposes, you'll need an app (Search & Reporting should do).