Hello,
i have a search head (deployment server) with ES and a distributed environment with suricata eve.json monitoring from the remote indexers. I would like to bring CIM compatible data in ES.
TA-suricata is installed using the deployment server to all clients. Suricata data are properly transformed. Checked data in remote indexer and are properly CIM parsed.
Installed TA-suricata in search head, but with the same search, I don't see the same data output. What shall I configure on inputs.conf?
I have in both SH and Indexers the following inputs.conf configuration:
[monitor]:///var/log/suricata/eve.json
disabled = false
index = suricata
sourcetype = suricata
source = /var/log/suricata/eve.json
Any help would be appreciated.
Thank you in advance,
Chris
