GoAnywhere App log suggestions, ideas

[inventsekar]

Hi All, So, there are no apps on splunkbase for "Goanywhere App", which is a "File Transfer Mobile App"

from their website:

GoAnywhere File Transfer Mobile App
Secure file management in the Bring Your Own Device (BYOD) workplace is now possible with the GoAnywhere File Transfer mobile app.

the logs are being sent to HF using syslog. 

so, i would like to ask you, if you have done some data ingestion manually,

- are there any special things to note down while doing manual data ingestion,

- which things you will be interested to ingest from a file-transfer-app

- any security related things to look for inside these GoAnywhere logs(as its a file transfer app, the users would be connecting from external network to corp network)

any pointers/suggestions/views please. thanks! 

Best Regards,

Sekar

[richgalloway]

There's nothing "special" to note.  Just be sure to include the usual "Magic Six" properties: TIME_PREFIX, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD, LINE_BREAKER, SHOULD_LINEMERGE, and TRUNCATE in your props.conf file.  Add FIELDALIAS settings as necessary to make the fields CIM-compliant.

At a minimum, I would extract the source and destination IP addresses, the file name, and the file size.  Try to extract all fields (at search time) in case you need them in a future use case.

[inventsekar]

Sure @richgalloway that gave a good idea,.. let me wait for a day or two for others suggestions/views, thanks.