Hi all, First time posting here and it's the first time I've been playing with Splunk. Downloaded and installed on Windows 10 (which is already seeming like a mistake - Splunk's handling of Syslog isn't great from what I've seen so far - one source on UDP/514 is bonkers!). I've used a lot of different SIEM tools in my time and have been working in IT Security for a number of years now; so I have a strong understanding of the usual process for log ingestion and it can usually be split into the following categories (this isn't a 'standard', it's just how I work things out in my head): Collection - How the logs are transported towards a SIEM (Syslog, Agent, API, etc.) Ingestion - Accepting the log sources into a SIEM. Parsing - Figuring out what logs belong to what log source types (i.e. CISCO ASA log belongs to CISCO ASA Version 'x') Indexing - Putting the correct Sections of logs into the correct columns (authentication event ID into that column) Association/Rules - Understanding which Events are successful logins and creating rules to link what you want to be alerted on. Searching and alerting - How alerts are displayed and searching through historical data using correlation rules etc. I understand Splunk isn't a 'SIEM' as such, so I'm not expecting to do the correlation bit just yet (probably an advanced way of achieving this, but I'm currently struggling with what I think is 3, 4, and 5. I've managed to get some of my logs into Splunk (3 x Windows devices and 1 x , so I'm pretty happy with the Collection and Ingestion side of things, but I've downloaded and installed two separate Security 'Apps' (InfoSec App for Splunk and Splunk Security Essentials) and neither appear to be understanding the logs that are being ingested. For instance, if I navigate to the "InfoSec App for Splunk", and just go Continuous Monitoring -> Firewalls or Network Traffic, I get absolutely nothing. See below: However, I know that the logs are arriving because if I go to "Search & Reporting", type the hostname in, I'm getting results back: I'm using a Sophos NGFW as my Core Firewall which has all sorts of features enabled on it (IPS, URL Filtering, DNS Alerting, QoS, etc.) Issue is that the apps don't appear to be seeing the logs which makes me thing that it's something to do with categories 3 to 5. I just don't know which one. I've downloaded, installed, and accelerated CIM, I've installed this add-on (which I thought covered the parsing and indexing stages); which leads me to believe it could be an association/rules issue. (Apparently I can't post links. Add on is "Sophos XG Technical Add-on") My major problem here is that I simply do not understand Splunk well enough to figure this out. So I was hoping some of you lovely people could help! Best, ... View more