Getting Data In
Highlighted

ESET endpoint logs

Hi , 

 

i am currently integrating logs from ESET endpoint security server , we have configured ESET to send logs in JSON format , but will i have applied _json sourcetype to the logs , it didn't parse correctly  .. Any ideas  ? 

 

 

 

<12>1 2020-06-28T13:13:25.32Z eset-esmc ERAServer 1319 - - {"event_type":"EnterpriseInspectorAlert_Event","ipv4":"4.5.6.7","hostname":"desktop123","source_uuid":"b851c1bc-0b62-4ca8-888c-c004e0d002f2","occured":"28-Jun-2020 13:09:06","severity":"Warning","processname":"%PROGRAMFILES(X86)%\\google\\update\\googleupdate.exe","username":"nt authority\\system","rulename":"Potential credential dumping - Generic [F0436a]","count":1,"hash":"842AE39880C3C0BC501007B42949950C3D3B7ED3","eiconsolelink":"https://EABC:443/console/detection/29"}

<14>1 2020-06-28T12:58:55.306Z eset-esmc ERAServer 1319 - - {"event_type":"Audit_Event","ipv4":"1.2.3.4","hostname":"eset","source_uuid":"4b643875-9b90-41b7-a046-cc30f6a331d3","occured":"28-Jun-2020 12:58:55","severity":"Information","domain":"Native user","action":"Logout","target":"Administrator","detail":"Logging out native user 'Administrator'.","user":"Administrator","result":"Success"}

 

 

 Thanks .

Labels (1)
Tags (1)
0 Karma
Highlighted

Re: ESET endpoint logs

SplunkTrust
SplunkTrust

Those sample events look like syslog with JSON message fields.  Since they're not pure JSON, the _json sourcetype won't work.  If you onboard the data using these props.conf settings

[ eset_syslog ]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD=32
NO_BINARY_CHECK=true
REPORT-syslog=syslog-extractions
SHOULD_LINEMERGE=false
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%Z
TIME_PREFIX=\d\s
TRANSFORMS=syslog-host
TRUNCATE=10000
disabled=false

then this search will extract the fields.

index=foo sourcetype=eset_syslog | rex "(?<json>\{.*)" | spath input=json

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: ESET endpoint logs

@richgalloway  thanks for your swift response .. in the meantime , i changed the logs format from the server  to leef and and made extraction at index time rather than search time using propos.conf and transforms.conf 

0 Karma
Highlighted
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.