Activity Feed
- Posted Re: How do I send AWS GuardDuty Logs to Splunk? on Splunk Enterprise Security. 04-18-2019 09:26 AM
- Posted How do I send AWS GuardDuty Logs to Splunk? on Splunk Enterprise Security. 04-10-2019 11:35 AM
- Tagged How do I send AWS GuardDuty Logs to Splunk? on Splunk Enterprise Security. 04-10-2019 11:35 AM
- Tagged How do I send AWS GuardDuty Logs to Splunk? on Splunk Enterprise Security. 04-10-2019 11:35 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-13-2018 09:10 AM
- Posted Re: Palo Alto Networks Apps - Only Realtime Event Feed Displays Data on All Apps and Add-ons. 12-13-2018 09:08 AM
- Posted Re: Palo Alto Networks Apps - Only Realtime Event Feed Displays Data on All Apps and Add-ons. 12-13-2018 07:49 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-13-2018 07:27 AM
- Posted Palo Alto Networks Apps - Only Realtime Event Feed Displays Data on All Apps and Add-ons. 12-13-2018 07:20 AM
- Tagged Palo Alto Networks Apps - Only Realtime Event Feed Displays Data on All Apps and Add-ons. 12-13-2018 07:20 AM
- Tagged Palo Alto Networks Apps - Only Realtime Event Feed Displays Data on All Apps and Add-ons. 12-13-2018 07:20 AM
- Tagged Palo Alto Networks Apps - Only Realtime Event Feed Displays Data on All Apps and Add-ons. 12-13-2018 07:20 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-13-2018 07:10 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-12-2018 11:41 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-12-2018 08:38 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-12-2018 07:06 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-12-2018 06:54 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-12-2018 06:43 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-12-2018 06:38 AM
- Posted Re: Palo Alto Networks App & Add-on Setup on Splunk Enterprise Security. 12-12-2018 06:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-18-2019
09:26 AM
Resolution:
The initial setup described in my opening post is correct, but the Lambda script needs to contain the following:
1) Correct VPC
2) Correct Subnet
3) Correct Security Group
4) Correct Role
Without these, the Lambda script will not be able to access a non-default VPC, and the Lambda script will continuously timeout (the error I was originally receiving).
Also, this can be done with an AWS Kinesis stream, though I have not set this up myself: https://www.splunk.com/blog/2018/02/22/serving-it-up-with-aws-and-splunk-aws-serverless-application-repository-now-available.html
This Kinesis Stream resolution may be required moving forward if Splunk does not update their blue-print for the AWS Lambda script. As of April 30, 2019, node.js v6.10 will be EOL in AWS and therefore the blueprint will be unavailable after this point.
Finally, the GuardDuty Add-on for Splunk should be installed to correctly parse the data that is ingested into Splunk.
Feel free to reach out if any questions on this.
... View more
04-10-2019
11:35 AM
Hello all,
I'm currently trying to send AWS GuardDuty logs to Splunk and am hoping someone here can help.
I'm using a method I've seen documented several places online:
Create an AWS CloudWatch Rule specifying AWS GuardDuty traffic.
Create a Lambda Function using the "splunk-logging" blueprint. Specify the desired sourcetype within the Node.js code for this to function properly.
Add the Lambda Function trigger to the CloudWatch Rule from Step 1.
Create a Splunk HTTP Event Collector and copy the HEC Token.
Enter the HEC Token and HEC URL to the Lambda Function so the logs are pointed to the correct resource (Splunk server).
I have completed the above and tried several variations, but no luck.
Any troubleshooting steps, alternative ways to accomplish this goal, or guides I have not found would be greatly appreciated. I would post the links to the resources I have found so far, but given a low "karma" count on this site, I am told my link would not publish in the final post.
Thank you.
... View more
12-13-2018
09:10 AM
Hi harsmarvania57,
After changing my search parameter to "All Time" under Presets, some of the other Dashboards have started showing data (though not all). I don't know why this is the case.
For right now, I'm content with this, despite the fact that I can't send logs directly from the Panorama. I will need to continue troubleshooting this to get logs to be accepted by the Indexers when not coming from our syslog server.
Thank you for all your help with this and providing the information that you did.
... View more
12-13-2018
09:08 AM
The other dashboards have started displaying data after selecting "all time" under the Presets. In addition, not all Dashboards show data -- just some.
Thank you.
... View more
12-13-2018
07:49 AM
Hi muralikoppula,
All Palo Alto datamodels have been accelerated already.
Thanks.
... View more
12-13-2018
07:27 AM
Yes, I've just confirmed this looking at the inputs.conf file.
I've also confirmed that Splunk is successfully parsing this data into the correct subtypes (e.g. pan:firewall) based on searches performed in the Search & Reporting app.
... View more
12-13-2018
07:20 AM
Hello all,
I've configured the Palo Alto Networks App & Add-on, and am receiving traffic on my Splunk Indexers and am able to search the data using my Search Heads.
In the Palo Alto Networks App, I navigate to Operations > Realtime Event Feed, and this dashboard displays statistics about live traffic and appears to be working normally.
However, if I navigate to any other dashboard, it shows there is no data. This is true even if I expand the search parameter to all-time.
Any ideas on how to resolve this?
Thank you!
... View more
12-13-2018
07:10 AM
Hello harsmarvania57,
I've been unable to get traffic directly from Panorama to the Splunk Indexer. I've pointed the Panorama syslogs back to the syslog server, and the Indexer is now receiving traffic.
I am back to troubleshooting the fact that the Realtime Event Feed displays data, but no other Dashboard does. I've read through the recommendations at https://splunk.paloaltonetworks.com/troubleshoot.html, and verified the following:
-Datamodel is fully built. All Palo Alto datamodels are at 100%.
-Acceleration is enabled.
Any further ideas?
... View more
12-12-2018
11:41 AM
Quick update:
As we've been discussing this, Panorama has been sending the syslog information to a syslog server, and that syslog server has a forwarder on it sending the traffic to the Splunk Indexer.
I've removed this configuration and created a new configuration forwarding logs directly from Panorama to the Splunk Indexer. After doing this, the Real-Time feed in the app is no longer displaying information, and I cannot search for new data in the Search & Reporting App. This tells me that there must be something wrong with the new configuration.
I'd like to correct this configuration before moving forward, as this is a fresh configuration that I'll be familiar with. I'm hopeful that once I can get data to be ingested properly with this configuration, data will be displayed on the remaining dashboards.
I will take some time to do this then provide an update here. Thank you for your help so far!
... View more
12-12-2018
08:38 AM
Still no luck unfortunately. Only the real-time dashboard is displaying data.
... View more
12-12-2018
07:06 AM
Okay, thank you. I will wait a few more minutes to see if the dashboards generate results.
A related question -- on the Palo Alto Network Add-on on the Indexer under the Configuration tab...what account are they asking for?
... View more
12-12-2018
06:54 AM
Looking under Operations -> Realtime Event Feed, I am actually seeing new data being fed in. Just no other dashboard appears to be working. I did enable Datamodel Acceleration.
... View more
12-12-2018
06:43 AM
And I would do this on the Search Head not the Indexer?
... View more
12-12-2018
06:38 AM
They are not accelerated. What would enabling this within the context of the Palo Alto app do?
... View more
12-12-2018
06:20 AM
Hi harsmarvania57,
I see various Palo Alto Networks Logs, but no indication of status. They seem to be built out though with various sourcetypes defined.
Size on disk is several TB with a small percentage being used. Diskspace should be no issue.
If the Search & Reporting app is able to find the logs from the Panorama, shouldn't the App be able to? Or is there a separate configuration page for the App for it to find the data?
... View more
12-12-2018
05:52 AM
Unfortunately I'm not able to get any of the Dashboards to display data -- Web Activity, User Behavior, etc. Again, despite being able to see the raw data in the Search & Reporting App.
... View more
12-12-2018
05:21 AM
Hi harsmarvania57, thanks for the reply.
I was able to get traffic from Panorama into the Splunk Indexer (I see traffic using the Search & Reporting App), but the data still isn't appearing in the Palo Alto Networks App.
Any idea why?
... View more
12-11-2018
11:02 AM
Hello all,
I am trying to get logs from Panorama into Splunk to analyze with the Palo Alto Networks App and Add-ons, and am hoping for some pointers in this process.
I am using one Search Head with Enterprise Security installed, and a separate server for the Indexer. Unfortunately all guides I've found assume both of these functions are present on the same server. The App is installed on the Search Head, and the Add-on is installed on the Indexer (per recommendation on this guide: https://splunk.paloaltonetworks.com/getting-data-in.html).
At this point I have two initial questions:
1) How can I ensure logs are sent to the Indexer and stored in the desired location?
2) Once logs are successfully sent to the Indexer, how will the App view data stored on the Indexer?
Thank you.
... View more
10-16-2018
10:56 AM
Thank you, kchamplin!
... View more
10-16-2018
08:59 AM
Is the GuardDuty Add-on officially supported on Splunk version 7.2? If not, are there plans to update it so it is supported?
Thank you.
... View more
