Splunk and QRadar integration

[andrey2007]

Hello,
I am interested in examples of integration of Splunk as data source to QRadar.
May be somebody has any? What kind of data, in what format and what way have you sent to Qradar?
Is it a complicated process?

Thanks for any advice!

[sbrant_splunk]

As stated, the Splunk real-time output app is no longer available. Here is the official guidance for forwarding data to another system: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

[sbrant_splunk · Accepted solution]

This depends on what sort of integration you have in mind. If you simply would like to forward data from Splunk to QRadar, then you have a number of options.

I'm not familiar with QRadar's method of data ingestion but I suspect it accepts syslog data, so that would be one (probably the easiest) option. There are a number of ways to send the syslog. It could be cloned and sent at the same time that Splunk indexes it, raw. You could also setup a real-time search and send (as syslog) the results of the search, using the Splunk Real-Time Output app.

[kefoster]

I downvoted this post because app is no longer there

[sbrant_splunk]

Whether or not there is benefit in integrating, primarily has to do with how vested you are in the use of qradar but also in how you want to use your data. The possibility for use cases, beyond what qradar can reasonably handle, is huge in Splunk. Of course, I'm speaking of the core capabilities of Splunk and not just ES.

Splunk is a platform and it does not require that your data be fully parsed when it is indexed, so unlike database driven SIEMs, data can be parsed at search-time, to accommodate different use cases. In addition, data not relevant in a SIEM can be utilized in Splunk.

[andrey2007]

Certainly now your answer is the most complete but i am interesting in use cases. As i know Qradar and splunk ES are quite equal products(SIEMs) and have the same reports. That is why it is interesting for me to know is any profit from such kind of integration.

[andrey2007]

to my sorry, no(

[jaoui]

any luck on this one?