We have a Synology NAS running on DSM 6.2.4-25556 Update 6
It has the feature to send logs to an IP address. I was wondering if it would be possible to use Splunk to monitor our NAS for suspicious activities such as a user downloading large amounts of files, logging in from a different location and so forth.
Below you can see the Log Sending available on the Synology DSM 6.2
Would this be compatible with Splunk? Would we need to host the Splunk server ourselves or does this work with a cloud solution?
Hi @Dawn ,
I think the usage of syslog and the Splunk UF could do the job.
NAS sends data to syslog
Splunk UF "collects" data from syslog and forward it to Splunk
NAS -> syslog-ng <- Splunk UF -> Splunk (Enterprise|Cloud)
Here some useful links:
https://community.splunk.com/t5/Getting-Data-In/Best-practices-Syslog-ng-to-splunk/m-p/470405
https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html