How to monitor an encrypted file?

[martinnepolean]

We have a requirement to monitor a control minder file which is encrypted.
We have Linux utility to decrypt the file and the command to decrypt is
seaudit -a -fn filename.

Please let me know how to set up monitoring for this file.

I like to decrypt and get the data into Splunk without duplicates.

[woodcock]

Take a look at how Splunk handles *.Z files and do the same thing. It has a built-in method of handling binaries that is in $SPLUNK_HOME/etc/system/default/props.conf:

[source::....Z(.\d+)?]
unarchive_cmd = splunk-compresstool -Z
sourcetype = preprocess-Z
NO_BINARY_CHECK = true

So you can do this:

[source::...YourDetailsHere]
unarchive_cmd = seaudit -a -fn 
sourcetype = preprocess-seaudit
NO_BINARY_CHECK = true

[kmorris_splunk]

You could create a scripted input in your inputs.conf that runs a script. Typically we would capture anything spit out to STDOUT and ingest it, but you could simply let the forwarder run the script against the encrypted file and drop the unencrypted version into a directory. You would have a second input that ingests those unencrypted versions.

Splunk used to do this for Netflow with one of the TAs, where the Netflow data was binary. A script would convert it to ASCII and drop it into a monitored folder.

Hope this helps.