Splunk Enterprise Security

Discarding Specific type of traffic either on forwarder or indexer fails

abwe
Loves-to-Learn Lots

Discarding Specific type of traffic either on forwarder or indexer fails, I tried to discard it using blacklist on forwarder and nullqueue transform on indexer and both failed.

here is a log sample

Oct 3 11:34:03 1.1.1.1 CEF:0|FORCEPOINT|Firewall|6.5.1|70018|Connection_Allowed|0|app=SNMP (UDP) rt=Oct 03 2019 11:28:12 deviceFacility=Packet Filtering act=Allow deviceOutboundInterface=13 deviceInboundInterface=0 proto=17 dpt=161 spt=62032 dst=2.2.2.2 src=3.3.3.3 dvchost=4.4.4.4 dvc=4.4.4.4 deviceExternalId=company-name node 1 cs1Label=RuleID cs1=2097272.10

and the configuration

props.conf
[forcepoint]
Transform-Forcepoint=discardsnmp

transforms.conf
[discardsnmp]
REGEX = app=SNMP
DEST_KEY = queue
FORMAT = nullQueue

any one can find out what is the problem?

0 Karma
1 Solution

ivanreis
Builder

please try this one: https://regex101.com/r/wgNicw/1

transforms.conf
[discardsnmp]
REGEX = \b(\w[a-zA-Z].*\Dapp=SNMP.+)
DEST_KEY = queue
FORMAT = nullQueue

View solution in original post

0 Karma

ivanreis
Builder

please try this one: https://regex101.com/r/wgNicw/1

transforms.conf
[discardsnmp]
REGEX = \b(\w[a-zA-Z].*\Dapp=SNMP.+)
DEST_KEY = queue
FORMAT = nullQueue

0 Karma

abwe
Loves-to-Learn Lots

Thanks, it worked like charm

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...