Getting Data In

Help with Query to monitor web traffic

waJesu
Explorer
I need help coming up with a query that can help create an IDPS/Internet Content Filtering dashboard in Splunk to continuously monitor the web traffic or pull reports when asked.
Labels (1)
Tags (1)
0 Karma

gcusello
Legend

Hi @waJesu,

your question is just a little bit vague: because at least you should share the technologies you're using.

Anyway, my hint is  to search in Splunkbase (apps.splunk.com) if there's an app for your technology that can guide you in data ingestion and presentation.

Ciao.

Giuseppe

0 Karma

waJesu
Explorer

We are using sourcefire as IDPS if that helps clarify

 

 

0 Karma

gcusello
Legend

Hi @waJesu,

sourcefire is unknown in apps.splunk.com, maybe you are speking of CISCO FireSIGHT.

In this case see the Add-on to take logs (https://splunkbase.splunk.com/app/1808/) that's a part of CISCO eStreamer.

About the App, these logs are usually used in the Splunk Enterprise Security, you could also see in the CISCO Suite for Splunk (https://splunkbase.splunk.com/app/5743/).

This is the best approach because otherwise, you should start to:

  • analyze the way to send data (syslog, Forwarders, or else),
  • take the data,
  • parse the data,
  • analyze data content,
  • extract all fields,
  • create your own dashboards.

For this reason I hinted to search for an App, usually from the Vendor (e.g. CISCO).

Ciao.

Giuseppe

0 Karma

waJesu
Explorer

Thank you. This should help.

0 Karma

gcusello
Legend

Hi @waJesu,

good for you, see next time!

If this answer solves your need, please, accept one answer for the other people of Community or tell me how I can help you more.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...