Splunk Enterprise Security

How to use Eventgen as a security event generator for Splunk App for Enterprise Security?

dimitryz
Path Finder

Hello all ,

Our company has Splunk ES 3.1.0.
I would like to know how to use SA-Evengen 2.0.3 ( which I downloaded and installed) with Enterprise Security as security event generator.
SA-Evengen seems to work OK,but I don't have any events on ES dashboards.

Shold I use /opt/splunk/etc/apps/TA-sav/default/eventgen.conf ?

I would appreciate any help.

Regards,
Dmitry

1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

1) install ES as instructed
2) download eventgen from https://github.com/splunk/eventgen
3) extract it to etc/apps/SA-Eventgen (yes, it should be named that).
4) review Eventgen in Manage Apps, you may want to make it visible.
5) Restart Splunk

The ES TAs and any new ones I'm involved in have eventgen.conf and samples in them that are ready to go.

View solution in original post

matthieu_araman
Communicator

Hello, I've installed ES 3.1 + Eventgen and I've events in security posture coming from eventgen generated logs.
I think I've also installed some other apps with eventgen conf like Splunk for windows architecture.
May you should try to install it alongside ?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

1) install ES as instructed
2) download eventgen from https://github.com/splunk/eventgen
3) extract it to etc/apps/SA-Eventgen (yes, it should be named that).
4) review Eventgen in Manage Apps, you may want to make it visible.
5) Restart Splunk

The ES TAs and any new ones I'm involved in have eventgen.conf and samples in them that are ready to go.

jcoates_splunk
Splunk Employee
Splunk Employee

you need to enable some correlation searches to get notable events

dimitryz
Path Finder

Hi jcoates_splunk,

Thank you for your help.
Most of the events are shown,but I do have a question.
I still don't see any events on Security Posture and Event Investigators.
Does it mean that it need some more work to do ?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...