Integration with Vectra NDR solution

[Bisho-Fouad]

how can i Integrate between splunk and Vectra NDR solution ?
what is the full path to get fully integration ?

[Bisho-Fouad]

Hello @richgalloway 

Thank you for your support. However, I would like to demonstrate that my NDR solution utilizes a centralized server called "Brain" to gather logs from network sensors. In order to achieve this, the optimal approach would be to establish a channel connecting the heavy forwarder to the NDR Brain.

Therefore, I would appreciate your recommendations on this matter.

so the best solution will be to create a channel between heavy forwarder and this NDR Brain

so what is your recommendations ??

[richgalloway]

Have you seen this guide for integrating Vectra with Splunk?  https://support.vectra.ai/s/article/KB-VS-1585

[richgalloway]

There are a few ways to onboard data into Splunk.

1. Install a universal forwarder on the server to send log files to Splunk
2. Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
3. Use the server's API to extract data for indexing
4. Use Splunk DB Connect to pull data from the server's SQL database.
5. Have the application send data directly to Splunk using HTTP Event Collector (HEC).