Hi Everyone so we are forwarding the Trend Micro Logs to a Splunk Agent that sends the logs to the Splunk server. The sourcetype is logged as Deep Security however i noticed the windows files are not being parsed properly and also i noticed i cannot view the Deep Security Agent versions ... Any help would be great Thank you, Alex, ... View more

Hi everyone, So in the past our customer was using a combination of Splunk and Ossec agents and that worked splendidly (to it's limit anyway) and now they have installed Deep Security package in order to use the OSSEC feature and collect Windows logs instead of the Splunk agent so as to avoid having multiple agents installed across the infrastructure. The Solution was to forward all of the logs towards a single Splunk Agent that will then collect and send to the Splunk Server. Now the logs are all coming in beautifully except for the format of the windows logs that are no longer being sent in XML format (as was the case with the Splunk Agent) which is now a bit of an issue for all of our dashboards that relied on that type of Parsing. Does anyone have any suggestions on how i could parse those logs coming from the Log Inspection in the same was as the Splunk Forwarder would ? Thanks 😃 Alexandre, ... View more