Getting Data In

Receive encrypted logs from ESET endpoint security

Mohali
Loves-to-Learn Lots

I'm planning to start an integration between Splunk and ESET endpoint security cloud platform, but I facing the following issue:

the Syslog-ng server started receiving uncleared/encrypted logs from the ESET endpoint security, so the logs appear on the HF server like this:


 ^A^B
 ^L
7 ^]
^W
 ^^
 ^Y
 ^X
#
^W
(^D^C^E^C^F^C^H^G^H^H^H ^H
2

I think I want to decrypt the logs when received by the syslog-ng because Splunk can't handle any decryption process, I need help with how I can decrypt the logs in the Syslog-ng.

Labels (1)
0 Karma

patrick9403
New Member

It looks like logs from ESET are encrypted.... because yes. I tried with syslog-ng and rsyslog but result is the same. I saw in the network that similar issue was reported directly to ESET

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Firstly, it's unclear what logs we're talking about and how they relate to syslog. If it's a cloud platform it's quite unusual to send raw syslog over open internet. If it's your local part of the installation (like the logs from the endpoints themselves) are you sure they are configured correctly? Are they supposed to send syslog?

0 Karma

patrick9403
New Member

Hi,

Did you find solution? I have the same issue.

 

0 Karma

_JP
Contributor

Since you're looking for help for syslog-ng configuration, your best bet is to join the syslog-ng community

But, from a Splunk architecture/design perspective you are on the right track.  Typically people use a separate syslog receiver that writes to disk (like syslog-ng), and then have Splunk monitor that.  This way you reduce the coupling for situations where you have to restart Splunk and don't want your syslog ports to be down.

That being said, there is a Splunk Connect for Syslog app that can be used for receiving syslog data, but I am unsure if it can handle the decryption for you if you are in a bind.  Overall I much prefer having syslog being received outside of Splunk.

 

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...