Splunk Enterprise Security

Best way to move windows logs via portable media from stand alone systems

swagner1965
Path Finder

Hi,

We use a few stand alone systems for scanning media and other tasks in our group. We are required to retrieve and archive these logs and since we use Splunk to do just that for everything else we want to work out a way to do the same with these systems. They are never plugged into the network and all movement of data in and out of these machines is via portable media.

What is the best way to do this? I want the data to end up indexed the same way that online systems are. Is there a way to use a fowarder on the stand alone system to write to a file that is easily consumed by Splunk or should I just massage the exported csv files from the Windows logs?

Cheers!

0 Karma

swagner1965
Path Finder

Answering this myself.

We are under RMF Controls which state that stand alone systems (sas) must have their logs pulled once a week. The sas is configured to retain its logs for a year. The requirement that logs be stored off system is met by placing a forwarder on the sas with the outputs.conf pointing to a local folder on the sas. That local folder is copied over to portable media which is then scanned prior to the files being moved into Splunk indexes on the enterprise network.

Since we are already doing virus definition updates weekly which involves portable media we have integrated the Splunk process into that.

0 Karma

joshuaah
Observer

Swagner,

I need to do the same things as you, in regards to pointing outputs.conf to local directory in an SAS. Do you have an example of the outputs.conf? how do you write the file to have all your data put in a local folder? Any help is much appreciated!

Thank you!

Josh

0 Karma

swagner1965
Path Finder

I am looking at putting a Forwarder on the stand alone systems but I need to figure out how to tell it to write the collected data to a file that can then be dropped in a network share and indexed from there. I am assuming I need to edit the outputs.conf in order to achieve this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...