Is there any repository for sample raw audit logs for various software platforms?

[adnankhan5133]

We are planning to procure several software platforms (e.g. Workday, Salesforce, Contact Center CX etc) in the near future as part of an expansion effort. I'm trying to get ahead and understand what the raw logs for each of these various platforms will look like so that our SOC Team can start producing pseudo SPL queries that we can eventually incorporate into Splunk for reporting and alerting. Is there any online repo that has sample raw logs from such platforms (preferably from their sandbox environment) that we could upload as flat files to Splunk and start experimenting with (e.g. parsing, transforming, etc)?

[inventsekar]

Hi @adnankhan5133 .. this will be a difficult task actually, to find out sample logs for some apps(just now i did search for Salesforce sample logs, but no luck)..

the EventGen is a good tool for creating the sample logs, but there are some challenges:

1) You should know the log format beforehand. 

2) configuring the EventGen, at times, is a difficult task. 

maybe, check this one.. we can get logs like.. hadoop, apache, openstack, many more apps sample logs are collected there.

https://github.com/logpai/loghub

[tej57]

Hello @adnankhan5133 ,

I'm not much aware of any repo present for raw logs for different platforms. However, you can use Eventgen to generate different logs before onboarding them into production.

You can refer to the following documents for using EventGen:

- https://splunkbase.splunk.com/app/1924

- http://splunk.github.io/eventgen/

----

If the above helps, an upvote is appreciated..!!