Splunk Enterprise

Splunk App for Linux Auditd Log

Symon
Explorer

Hello Sirs,

I would like to know the most useful Splunk App that can be suitable for Linux Auditd events. I have Linux devices such as Mangement Servers, DNS, HTTP Servers, Firewall, etc. These logs carried by both Syslog Forwarder and Heavy forwarders. 


Please suggest how to monitor the audit logs by which Splunk App?

Thanks a bunch.

0 Karma

kiran_panchavat
Influencer

@Symon  

To effectively monitor Linux Auditd events in Splunk, you can use the Splunk Add-on for Linux.

This add-on allows you to collect and analyze audit logs from your Linux devices. Here’s how you can set it up:

Configure AuditD to Send Data to the Splunk Add-on for Linux:

https://docs.splunk.com/Documentation/AddOns/released/Linux/Configure4 
https://splunkbase.splunk.com/app/833 

This Add On for linux Auditd allows Administrators to make their data OCSF Compliant and CIM compliant for related Linux Auditd Events

https://preview.splunkbase.splunk.com/app/7045 

 

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Symon
Explorer

Thanks. Noted sir.

Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...