Getting Data In

How to monitor an encrypted file?

martinnepolean
Explorer

We have a requirement to monitor a control minder file which is encrypted.
We have Linux utility to decrypt the file and the command to decrypt is
seaudit -a -fn filename.

Please let me know how to set up monitoring for this file.

I like to decrypt and get the data into Splunk without duplicates.

0 Karma

woodcock
Esteemed Legend

Take a look at how Splunk handles *.Z files and do the same thing. It has a built-in method of handling binaries that is in $SPLUNK_HOME/etc/system/default/props.conf:

[source::....Z(.\d+)?]
unarchive_cmd = splunk-compresstool -Z
sourcetype = preprocess-Z
NO_BINARY_CHECK = true

So you can do this:

[source::...YourDetailsHere]
unarchive_cmd = seaudit -a -fn 
sourcetype = preprocess-seaudit
NO_BINARY_CHECK = true
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

You could create a scripted input in your inputs.conf that runs a script. Typically we would capture anything spit out to STDOUT and ingest it, but you could simply let the forwarder run the script against the encrypted file and drop the unencrypted version into a directory. You would have a second input that ingests those unencrypted versions.

Splunk used to do this for Netflow with one of the TAs, where the Netflow data was binary. A script would convert it to ASCII and drop it into a monitored folder.

Hope this helps.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...