Forwarding splunk'd logs to third party siem - McAfee ESM

[MattQ]

I am told it is very simple to take already indexed events from splunk and send them over to a 3rd party SIEM appliance like McAfee ESM.

Has anyone done this successfully? How hard was it to implement? Can you limit / forward only selected events? Can you limit forwarding to only select hosts or log types?

I have seen a few other similar questions and it seems INCREDIBLY simple, to the point of adding only a few lines of code to a few files. Is it really that easy?

[jtrucks · Accepted solution]

Use the REST or other API or the CLI to perform a search (scheduled or even real-time) and have the results sent to whatever API or file the other tool uses.

It's relatively simple, really, and you can do this with any search you want so you can send selective results to your other tool.

[kupawar]

please refer any link or document.

[sdaniels]

You could also use a heavy forwarder and forward the data to McAfee via syslog at the same time as it sends it to your Splunk indexer. Of course this is before the data is indexed. This will also give you the flexibility to send a subset of the data. See the docs below:

http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Forwarddatatothird-partysystemsd

[mariogiovannitt]

I configured the outputs.conf in my etc/local dir to forward AD logs from an indexer to a 3rd part SIEM . restarted, and still no joy. any ideas.

[dshpritz]

You may also want to look at the Real-Time output app:

http://splunk-base.splunk.com/apps/48082/splunk-real-time-output