Splunk Integration for Crypto Object Discovery

[Priyanka8440]

Hello Team,
I am working on a requirement to discover cryptographic objects using Splunk. I need to collect relevant log data containing information such as TLS versions, ciphers, certificates, IPs, hosts, ports, and protocols.
Could you please suggest how this data can be collected and integrated into Splunk, and which log sources or Splunk are recommended?
Thank you!

[_Raj]

Hi,

For cryptographic-object discovery in Splunk, I would prioritize the sources like this

     

Log source / Splunk product	What you can collect
Splunk Stream	TLS version, cipher, source/destination IP, ports, protocol, certificate/TLS metadata
F5 / Palo Alto / Fortinet / proxy / load balancer logs	TLS versions, ciphers, certificates, client/server IPs, ports
Nginx / Apache / HAProxy / API Gateway logs	TLS version, cipher, server name, client IP, certificate-related information
Windows Schannel Event Logs	TLS/SSL and certificate events
Linux/OpenSSL certificate inventory	Certificate subject, issuer, expiry, algorithm, key length, fingerprint
Splunk Enterprise Security	Certificates data model, dashboards, correlation/searching