Monitoring of activity - Is Synology NAS DSM 6.2 compatible with Splunk?

[Dawn]

We have a Synology NAS running on DSM 6.2.4-25556 Update 6

It has the feature to send logs to an IP address. I was wondering if it would be possible to use Splunk to monitor our NAS for suspicious activities such as a user downloading large amounts of files, logging in from a different location and so forth.

Below you can see the Log Sending available on the Synology DSM 6.2

Would this be compatible with Splunk? Would we need to host the Splunk server ourselves or does this work with a cloud solution? 

[manuelostertag]

Hi @Dawn ,

I think the usage of syslog and the Splunk UF could do the job.

NAS sends data to syslog
Splunk UF "collects" data from syslog and forward it to Splunk

NAS -> syslog-ng <- Splunk UF -> Splunk (Enterprise|Cloud)

1. Install and setup syslog (for e.g syslog-ng) on a server
2. Install and setup Splunk UF on a server (this could be the same server as in step 1); the UF should monitor the file(s) which will created by the syslog-ng and forward them to you Splunk instance (Enterprise or Cloud)
3. Configure your NAS to send the data to the syslog-ng server

Here some useful links:
https://community.splunk.com/t5/Getting-Data-In/Best-practices-Syslog-ng-to-splunk/m-p/470405

https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html