Getting Data In

WatchGuard FireBox Assistance

AJSCSA
Loves-to-Learn Lots

Hello Everyone,

 

I'm hoping to get some assistance.  My company using WatchGuard Firebox firewalls.  I'm working to get the data correcting ingested into Splunk and get all the fields extracted (HIGHLY prefer a CIM complaint format) but the only WatchGuard App and TA Addon I've found are outdated, poorly written (I've been told) and are not CIM compliant.  Is there an easy way to pull the information from the WatchGuard Log Catalog (https://www.watchguard.com/help/docs/fireware/12/en-US/log_catalog/Log-Catalog_v12_5.pdf) and put it into Splunk to properly ingest and label the data coming in from WatchGuard logs?

 

AJSCSA_0-1606783212014.png

 

 

Thanks for any and all assistance with this!

Labels (1)
0 Karma

vikramyadav
Contributor

Hi @AJSCSA ,

Do you have properly configured soucretype ?

vikramyadav_0-1617174529501.png


Also I have got one doc please try that out.
https://www.watchguard.com/help/docs/help-center/en-US/Content/Integration-Guides/General/splunk_int...

 

--------------------------------------------------------------------------
If this helps your like will be appreciate. 😊

 

0 Karma

a_n
Path Finder

Hi there,

First of all, I am not a professional splunker but due to my case, I have to dig deep for some scenarios on the watchguard firebox devices.

Please note that, based on my experience so far on watchguard (again I am not guru) the app and add-on does not handle the fields extraction properly.
I just used them so far for the source type (watchguard:firebox:syslog) and I am extracting most of the fields on my own.

Please advise which fields do you need them the most, maybe we can help each other.

I am using this regular expression for for Source_IP, Destination_IP, Source_Port and Destination_Port:

(?<src_ip>\d+\.\d+\.\d+\.\d+) (?<dst_ip>\d+\.\d+\.\d+\.\d+) (?<src_portt>\d+) (?<dst_port>\d+)
So far it covers all my needs for the required searches/dashboards.
(do not forget the SPACES)

Please advise if it helps you.

Regards,

Tags (1)
0 Karma

AJSCSA
Loves-to-Learn Lots

Any chance anyone could look at this and offer some advice?  Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...