How to Receive Kaspersky Security Center Logs via Syslog with TLS?

[refahiati]

Hi everyone,

I am trying to configure Kaspersky Security Center to forward logs to Splunk using Syslog over TLS. However, I need some guidance on the following points:

• How can I configure Kaspersky Security Center to send logs via Syslog over TLS?

• What are the steps to generate the necessary certificates for this setup?

• Which certificate formats or file extensions does Kaspersky Security Center accept for TLS encryption?

• Are there any specific configurations required on the Splunk side to properly receive and parse these logs over TLS?

I would appreciate any insights, best practices, or documentation references that could help.

Thank you in advance!

[PickleRick]

Most of those questions are not about Splunk but about the other end - the Kaspersky solution. You should consult their support/community/docs.

The only question related to Splunk is the last one and the general answer is - don't do it directly on Splunk component. Use an external syslog daemon - syslog-ng, rsyslog, SC4S and either send to HEC input on Splunk or write to files and read those files with UF.