Hi everyone, I’m trying to pair Splunk SOAR (On-premises) with Splunk Enterprise Security through Configure → Pairing → Establish connection in ES. When I enter the SOAR base URL and local admin credentials, the pairing fails with this error: Unable to pair – Your current SOAR license (status: community) does not allow for pairing with ES. Contact your Splunk representative for details. Environment: Splunk Enterprise Security 8.x (with Mission Control) Splunk SOAR On-premises, currently on the Community license Lab / test environmen Is there a trial license for ES Premier (or an equivalent SOAR trial) that allows pairing for lab/POC use?   ... View more

Hi, I have rule to detect some suspicious activity and want to add the source IP into the ES Threat Intel, However Threat Group is multi- dropdown choiches with 'No Matched'.  What is the issue here? ... View more

Hi All, I want to share with you the Syslog-NG configuration, you can review and advise. [+] Syslog-ng Preparation ============================================ Check SELinux status getenforce sudo mkdir -p /var/log/syslog sudo chown -R splunk:splunk /var/log/syslog sudo chmod 750 /var/log/syslog sudo tee /etc/sysctl.d/99-syslog-ng.conf > /dev/null << 'EOF' # Syslog-ng UDP receive buffer tuning net.core.rmem_max = 33554432 net.core.rmem_default = 16777216 net.core.netdev_max_backlog = 5000 # TCP keepalive - fast dead-peer detection after keepalived VIP failover net.ipv4.tcp_keepalive_time = 120 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 5 EOF sudo sysctl --system sudo sysctl net.core.rmem_max net.core.rmem_default net.core.netdev_max_backlog net.ipv4.tcp_keepalive_time ============================================ [+] Syslog-NG Configuration =========================== sudo tee /etc/syslog-ng/conf.d/data_sources.conf > /dev/null << 'EOF' ############################################################################### # GLOBAL OPTIONS ############################################################################### options { log-fifo-size(200000); threaded(yes); use-dns(no); dns-cache(no); keep-hostname(no); chain-hostname(no); log-msg-size(65536); }; ############################################################################### # RAW MESSAGE TEMPLATE ############################################################################### template t_raw { template("$MSG\n"); template_escape(no); }; ############################################################################### # TCP SOURCES ############################################################################### # FortiGate - TCP 1515 source s_fortigate { network( ip(0.0.0.0) transport(tcp) port(1515) flags(no-parse, flow-control) max-connections(100) log-iw-size(10000) so-keepalive(yes) so-rcvbuf(1048576) ); }; ############################################################################### # UDP SOURCES ############################################################################### # F5 WAF - UDP 2514 source s_f5waf { network( ip(0.0.0.0) transport(udp) port(2514) flags(no-parse) so-rcvbuf(4194304) ); }; ############################################################################### # TCP DESTINATIONS ############################################################################### # FortiGate destination d_fortigate { file( "/var/log/syslog/fortigate/${SOURCEIP}/${SOURCEIP}-$YEAR-$MONTH-$DAY-$HOUR.log" create_dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750) owner("splunk") group("splunk") perm(0640) template(t_raw) fsync(no) ); }; ############################################################################### # UDP DESTINATIONS ############################################################################### # F5 WAF destination d_f5waf { file( "/var/log/syslog/f5waf/${SOURCEIP}/${SOURCEIP}-$YEAR-$MONTH-$DAY-$HOUR.log" create_dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750) owner("splunk") group("splunk") perm(0640) template(t_raw) fsync(no) ); }; ############################################################################### # LOG PATHS ############################################################################### log { source(s_fortigate); destination(d_fortigate); flags(final); }; log { source(s_f5waf); destination(d_f5waf); flags(final); }; ############################################################################### # END ############################################################################### EOF ============================================ [+] Validate & Start ============================================ sudo syslog-ng -s sudo systemctl restart syslog-ng sudo systemctl status syslog-ng --no-pager sudo ss -lntup | grep 1514 ss -ulm sport = :2514 ============================================ [+] Testing ============================================ loggen --size 500 --rate 1000 --interval 600 10.0.0.1 514 logger --server 127.0.0.1 --port 1514 --tcp "PALOALTO_TCP_TEST" logger --server 127.0.0.1 --port 2514 --udp "PALOALTO_UDP_TEST" echo '<134>date=2026-08-11 time=13:00:00 devname=PA01 type=TRAFFIC action=allow srcip=10.1.1.1 dstip=10.2.2.2' | nc -w1 10.0.4.160 1514 ============================================ ... View more

Hi, I hope u all are doing well. I am seeking for the best integration method for the below: Seclore DRM Delinea PAM Arbor Ddos Gemalto 2FA Tipping point IPS/IDS Thales encryption Ivanti VPN fortiweb fortimanager Carbon black EDR Trellix “HX EDR, sandbox EX” Aruba clearpass ... View more

Dears, I hope all is well. As per the below: https://help.splunk.com/en/data-management/manage-splunk-enterprise-indexers/10.4/back-up-and-archive-your-indexes/archive-indexed-data#d1b62f12_ea26_4717_bfaa_0038cd295758--en__Archive_indexed_data  The problem of archiving multiple copies Because indexer clusters contain multiple copies of each bucket. If you archive the data using the techniques described earlier in this topic, you archive multiple copies of the data. While working with IndexerCluster, how to ensure just one single copy of the RAW data has been archive, however the replication factor more than 2. ... View more

Dear All, Just to confirm the below "UFs call the Deployment server and ask for their apps, the deployment server never calls the UFs. So you don't need bodirectional from UFs to DS." The connection from Splunk UF to the Splunk DC over TCP/8089 is  outbound/unidirectional?  ... View more

Hi, Kindly, we plan to upgrade from the Splunk ES 7.3.4 to the latest 8.5.1. please confirm the upgrade path wil be direct upgrade from the current to the latest 8.5.x? https://help.splunk.com/en/splunk-enterprise-security-8/install/8.5/upgrading/upgrade-splunk-enterprise-security  ... View more