About mlmcadams

mlmcadams · ‎09-20-2022

Last time I reviewed this function with Azure cloud, I saw the cost was when the Azure Event Hubs were used. The problem is Microsoft changes their service quite a bit and there still might be a charge without using the hubs. It is very worth it asking your Microsoft account representative team to be fully sure. Hope this helps.

mlmcadams · ‎09-20-2022

Excellent solution thanks for sharing it @nickhills

mlmcadams · ‎08-28-2020

What is the best practice of importing CEF files into Splunk, retrieved from Forcepoint CASB's siem tool? We have a Windows server that is downloading the cef files from Forcepoint CASB into into its local directories. We have a Splunk universal forwarder installed on this server as well. We also have a heavy forwarder, search head and three indexers running 8.0.5.

mlmcadams · ‎01-27-2015

We have many devices sending logs to QRadar. Is it possible to forward logs from QRadar to Splunk and still be able to correlate the data for each device in Splunk?

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-27-2015

Online Status	Offline
Date Last Visited	Thursday

Import Forcepoint CASB CEF files into Splunk

Is it possible to forward logs from QRadar to Splu...

Re: Would there be any Cost involved from Azure if...

Re: When monitoring events coming into Splunk, how...

Import Forcepoint CASB CEF files into Splunk

Is it possible to forward logs from QRadar to Splu...

Are you a member of the Splunk Community?

Import Forcepoint CASB CEF files into Splunk

Is it possible to forward logs from QRadar to Splu...

Re: Would there be any Cost involved from Azure if...

Re: When monitoring events coming into Splunk, how...

Import Forcepoint CASB CEF files into Splunk

Is it possible to forward logs from QRadar to Splu...