Getting Data In

How best to ingest SECURE TCP (Encrypted Syslog) with AirWatch?


Are there any recommendations on how best to ingest TLS encrypted syslog from AirWatch Cloud Console?  The only settings in AirWatch are to select UDP, TCP or SECURETCP and the port.  I opened a case with VMWare and they suggested to open a case with our SIEM provider for recommedations.  I suspect the recommendation may be to send logs to an rsyslog and then use forwarder to send to splunk since that supports SSL to Splunk.  Has anyone successfully done Encrypted Syslog from Airwatch?

Labels (1)
0 Karma

Ultra Champion

I suppose you could try to fiddle with tcp input and configuring tls settings for it - should be possible but not very convenient.

You can also do it with rsyslog. Configure imtcp - not imptcp - input and either write to files for UF to read or send directly to HEC input on Splunk.

You probably can do similar thing with sc4s but I'm not an expert here.

0 Karma

Path Finder

I'm running into the same issue, but with Ricoh printers.  But my direction will be what you outlined with sending to SYSLOG, writing to file and forwarder to read that file.


0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...