Hi, I have rule to detect some suspicious activity and want to add the source IP into the ES Threat Intel, However Threat Group is multi- dropdown choiches with 'No Matched'.  What is the issue here? 2026-08-24_011913.png ... View more

Hi All, I want to share with you the Syslog-NG configuration, you can review and advise. [+] Syslog-ng Preparation ============================================ Check SELinux status getenforce sudo mkdir -p /var/log/syslog sudo chown -R splunk:splunk /var/log/syslog sudo chmod 750 /var/log/syslog sudo tee /etc/sysctl.d/99-syslog-ng.conf > /dev/null << 'EOF' # Syslog-ng UDP receive buffer tuning net.core.rmem_max = 33554432 net.core.rmem_default = 16777216 net.core.netdev_max_backlog = 5000 # TCP keepalive - fast dead-peer detection after keepalived VIP failover net.ipv4.tcp_keepalive_time = 120 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 5 EOF sudo sysctl --system sudo sysctl net.core.rmem_max net.core.rmem_default net.core.netdev_max_backlog net.ipv4.tcp_keepalive_time ============================================ [+] Syslog-NG Configuration =========================== sudo tee /etc/syslog-ng/conf.d/data_sources.conf > /dev/null << 'EOF' ############################################################################### # GLOBAL OPTIONS ############################################################################### options { log-fifo-size(200000); threaded(yes); use-dns(no); dns-cache(no); keep-hostname(no); chain-hostname(no); log-msg-size(65536); }; ############################################################################### # RAW MESSAGE TEMPLATE ############################################################################### template t_raw { template("$MSG\n"); template_escape(no); }; ############################################################################### # TCP SOURCES ############################################################################### # FortiGate - TCP 1515 source s_fortigate { network( ip(0.0.0.0) transport(tcp) port(1515) flags(no-parse, flow-control) max-connections(100) log-iw-size(10000) so-keepalive(yes) so-rcvbuf(1048576) ); }; ############################################################################### # UDP SOURCES ############################################################################### # F5 WAF - UDP 2514 source s_f5waf { network( ip(0.0.0.0) transport(udp) port(2514) flags(no-parse) so-rcvbuf(4194304) ); }; ############################################################################### # TCP DESTINATIONS ############################################################################### # FortiGate destination d_fortigate { file( "/var/log/syslog/fortigate/${SOURCEIP}/${SOURCEIP}-$YEAR-$MONTH-$DAY-$HOUR.log" create_dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750) owner("splunk") group("splunk") perm(0640) template(t_raw) fsync(no) ); }; ############################################################################### # UDP DESTINATIONS ############################################################################### # F5 WAF destination d_f5waf { file( "/var/log/syslog/f5waf/${SOURCEIP}/${SOURCEIP}-$YEAR-$MONTH-$DAY-$HOUR.log" create_dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750) owner("splunk") group("splunk") perm(0640) template(t_raw) fsync(no) ); }; ############################################################################### # LOG PATHS ############################################################################### log { source(s_fortigate); destination(d_fortigate); flags(final); }; log { source(s_f5waf); destination(d_f5waf); flags(final); }; ############################################################################### # END ############################################################################### EOF ============================================ [+] Validate & Start ============================================ sudo syslog-ng -s sudo systemctl restart syslog-ng sudo systemctl status syslog-ng --no-pager sudo ss -lntup | grep 1514 ss -ulm sport = :2514 ============================================ [+] Testing ============================================ loggen --size 500 --rate 1000 --interval 600 10.0.0.1 514 logger --server 127.0.0.1 --port 1514 --tcp "PALOALTO_TCP_TEST" logger --server 127.0.0.1 --port 2514 --udp "PALOALTO_UDP_TEST" echo '<134>date=2026-08-11 time=13:00:00 devname=PA01 type=TRAFFIC action=allow srcip=10.1.1.1 dstip=10.2.2.2' | nc -w1 10.0.4.160 1514 ============================================ ... View more

Hi, I hope u all are doing well. I am seeking for the best integration method for the below: Seclore DRM Delinea PAM Arbor Ddos Gemalto 2FA Tipping point IPS/IDS Thales encryption Ivanti VPN fortiweb fortimanager Carbon black EDR Trellix “HX EDR, sandbox EX” Aruba clearpass ... View more

Dears, I hope all is well. As per the below: https://help.splunk.com/en/data-management/manage-splunk-enterprise-indexers/10.4/back-up-and-archive-your-indexes/archive-indexed-data#d1b62f12_ea26_4717_bfaa_0038cd295758--en__Archive_indexed_data  The problem of archiving multiple copies Because indexer clusters contain multiple copies of each bucket. If you archive the data using the techniques described earlier in this topic, you archive multiple copies of the data. While working with IndexerCluster, how to ensure just one single copy of the RAW data has been archive, however the replication factor more than 2. ... View more

Dear All, Just to confirm the below "UFs call the Deployment server and ask for their apps, the deployment server never calls the UFs. So you don't need bodirectional from UFs to DS." The connection from Splunk UF to the Splunk DC over TCP/8089 is  outbound/unidirectional?  ... View more

Hi, Kindly, we plan to upgrade from the Splunk ES 7.3.4 to the latest 8.5.1. please confirm the upgrade path wil be direct upgrade from the current to the latest 8.5.x? https://help.splunk.com/en/splunk-enterprise-security-8/install/8.5/upgrading/upgrade-splunk-enterprise-security  ES Path.png ... View more

Hi, I want to integrate MS Exchange Server : Version 2022 using the below TA-Addon: Splunk Add-on for Microsoft Exchange https://splunkbase.splunk.com/app/3225 However, I found it just supports the 2016 and 2019 MS version, could we also use it with MS Exchange Server : Version 2022 or not? ... View more