How to import cef data from data source in splunk ...

sampy93 · ‎04-10-2018

I tried many times to import raw data (CEF) from another SIEM (just to test) and configured to send data to a specific port with zero results.
Any ideas on what is the correct procedure to do this?
Thanks

adonio · ‎04-10-2018

you can take data directly from CEF to splunk, there is also an app for it:
https://splunkbase.splunk.com/app/1847/#/overview
installation and configuration here:
http://docs.splunk.com/Documentation/CEFapp/2.0.1/DeployCEFapp/AboutSplunkAppforCEF
what is the other SIEM tool?

How to import cef data from data source in splunk enterprise without an agent?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation