Getting Data In

Are there currently supported methods for ingesting and monitoring Suricata events in Splunk?

opoplawski
Explorer

Are there currently supported methods for ingesting and monitoring Suricata events in splunk?

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is an old TA on splunkbase (https://splunkbase.splunk.com/app/4242).  Perhaps it will help.

If not, there are a few ways to onboard data into Splunk.

Install a universal forwarder on the server to send log files to Splunk
Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
Use the server's API to extract data for indexing
Use Splunk DB Connect to pull data from the server's SQL database.
Have the application send data directly to Splunk using HTTP Event Collector (HEC).

What you mean by "supported"?  The TA is unsupported.  The onboarding methods are standard in Splunk, but Splunk Support will not help you with them as they are break/fix only.

---
If this reply helps you, Karma would be appreciated.
0 Karma

opoplawski
Explorer

I'm suspicious of the old TA for Suricata because it mentions splunk 7.2 and CIM 4.x, but I'll guess I'll test it out.

I guess I'm looking for "useful" more than anything else.  Something that will display the events in a useful way.


0 Karma

richgalloway
SplunkTrust
SplunkTrust

The old TA can be used as a guide to create your own TA that is more up-to-date.

Neither TA will display events as they only help onboard them.  For display purposes, you'll need an app (Search & Reporting should do).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...