Security

Splunk ES fortinet new source

splunkcol
Builder

Hello,


I was given the administration of a Splunk Enterprise Security and I am not familiarized, I have always used manual queries from "Search & reporting" I have the knowledge level of Fundamentals 1 and 2.

Splunk ES currently works and I can see noticeable events from paloalto firewalls but recently configured fortinet logs and these are already coming in under an index called fortinet, when doing a normal query with index=fortinet I can see events but I see nothing from Splunk ES.

Exactly what do I need to do to get the fortinet events to be taken into account by Splunk ES and start logging notable events?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I strongly encourage you to take the free Using Splunk ES (Using Splunk Enterprise Security ) and the (not free) Administering Splunk ES (Administering Splunk Enterprise Security ) courses.

ES uses correlation searches to create notable events.  A CS is like a saved search, but will a few added attributes.  You can create a CS in ES by going to Configuration->Content Management and clicking on the New Correlation Search button.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...