Installation

Forwarding splunk'd logs to third party siem - McAfee ESM

MattQ
Explorer

I am told it is very simple to take already indexed events from splunk and send them over to a 3rd party SIEM appliance like McAfee ESM.

Has anyone done this successfully? How hard was it to implement? Can you limit / forward only selected events? Can you limit forwarding to only select hosts or log types?

I have seen a few other similar questions and it seems INCREDIBLY simple, to the point of adding only a few lines of code to a few files. Is it really that easy?

1 Solution

jtrucks
Splunk Employee
Splunk Employee

Use the REST or other API or the CLI to perform a search (scheduled or even real-time) and have the results sent to whatever API or file the other tool uses.

It's relatively simple, really, and you can do this with any search you want so you can send selective results to your other tool.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Use the REST or other API or the CLI to perform a search (scheduled or even real-time) and have the results sent to whatever API or file the other tool uses.

It's relatively simple, really, and you can do this with any search you want so you can send selective results to your other tool.

--
Jesse Trucks
Minister of Magic

kupawar
New Member

please refer any link or document.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

You could also use a heavy forwarder and forward the data to McAfee via syslog at the same time as it sends it to your Splunk indexer. Of course this is before the data is indexed. This will also give you the flexibility to send a subset of the data. See the docs below:

http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Forwarddatatothird-partysystemsd

mariogiovannitt
New Member

I configured the outputs.conf in my etc/local dir to forward AD logs from an indexer to a 3rd part SIEM . restarted, and still no joy. any ideas.

0 Karma

dshpritz
SplunkTrust
SplunkTrust

You may also want to look at the Real-Time output app:

http://splunk-base.splunk.com/apps/48082/splunk-real-time-output

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...