Splunk Enterprise Security

Using Splunk for Snort, how do I get Snort Alert Fast logs into the Splunk App for Enterprise Security?

jdanij
Path Finder

I'm a bit stuck with this. This is my situation:

  1. I've installed Snort between the LAN and its GW and all traffic has to go through Snort. This is working perfectly.
  2. Snort has enabled 2 outputs. 1) unified2, used to introduce data into a Snorby and 2) alert_fast to a file. This file is being readed by a splunk UF and sent to the Indexer.
  3. I've installed Splunk for Snort on the indexer receiving Snort alert fast data, it's CIM compliant and should fit into an Enterprise Security environment. I think so at least. As the doc says, this data is being sourcetyped as snort_alert_fast. This app will process it and changes the sourcetype for snort once cim fields have been created. This is working too, I've double-checked it in the search panel.

Now, this is my problem. I can't find any kind of data regarding this in the Enterprise security APP.

  1. In which panel is it supposed to be showing statistics and data from Snort? I guess in any part of the threat menu, but every counter or graph is empty.
  2. How can I check if Snort data is being processes by the Splunk App for Enterprise Security?

Taking advantage of this question, Splunk for ES is not generating any Notable events... I have no clue about this.

JSkier
Communicator

Security Domains > Network > Intrusion Center

That should answer both of your questions quickly. The trends at the top, alert severity, alert tables should be populated if the sourcefire TA (CIM compliant) is properly configured and up-to-date.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...