Using splunk forwarder to send system/application logs to another SIEM like ArcSight

[balbano]

Hi Guys,

We are using a third party solution to help us monitor event logs and they use ArcSight as their SIEM Solution.

Since Splunk is sending both system logs and application logs to our indexers, I would like to know what is the best way to forward events to their ArcSight solution. We are hosting a VM appliance tool within our infrastructure that will forward the events to the third party monitoring solution but wanted some clarification on some items:

1. To send the data, is it just a matter of configuring outputs.conf on the forwarder to send data to the VM appliance?
2. Is it possible to still use SSL within Splunk to send data from the forwarder to the ArcSight appliance?
   1. Is there anything else I may be missing that I need to be aware of?

If someone can help me clarify these items that would be great.

Thanks.
Brian

[davecroto]

You would have to parse the data into CEF format, but it is possible.

Google and download the PDF:

Integrating Splunk with ArcSight