Getting Data In

How to monitor an encrypted file?

martinnepolean
Explorer

We have a requirement to monitor a control minder file which is encrypted.
We have Linux utility to decrypt the file and the command to decrypt is
seaudit -a -fn filename.

Please let me know how to set up monitoring for this file.

I like to decrypt and get the data into Splunk without duplicates.

0 Karma

woodcock
Esteemed Legend

Take a look at how Splunk handles *.Z files and do the same thing. It has a built-in method of handling binaries that is in $SPLUNK_HOME/etc/system/default/props.conf:

[source::....Z(.\d+)?]
unarchive_cmd = splunk-compresstool -Z
sourcetype = preprocess-Z
NO_BINARY_CHECK = true

So you can do this:

[source::...YourDetailsHere]
unarchive_cmd = seaudit -a -fn 
sourcetype = preprocess-seaudit
NO_BINARY_CHECK = true
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

You could create a scripted input in your inputs.conf that runs a script. Typically we would capture anything spit out to STDOUT and ingest it, but you could simply let the forwarder run the script against the encrypted file and drop the unencrypted version into a directory. You would have a second input that ingests those unencrypted versions.

Splunk used to do this for Netflow with one of the TAs, where the Netflow data was binary. A script would convert it to ASCII and drop it into a monitored folder.

Hope this helps.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...