ForeScout CounterACT Syslog Add-on for Splunk

The purpose of this add-on is to provide value to your ForeScout CounterACT syslog logs (ONLY SYSLOG!). This is done by making the logs CIM compliant, adding tagging for Enterprise Security data models, and other knowledge objects to make searching and visualizing this data easy. This add-on assumes you are onboarding the data either using a syslog collector that outputs to a file or using the built-in Splunk TCP/UDP listener (I would highly recommend the former)--the knowledge objects will work for any ingestion method if you use the correct sourcetype. Regardless of ingestion method, you may need to adjust some of the props.conf settings for proper line breaking and timestamp parsing. +Built for Splunk Enterprise 6.x.x or higher +CIM Compliant (CIM 4.0.0 or higher) +Ready for Enterprise Security +Built based on ForeScout CounterACT Syslog Plugin 3.2.0 Documentation ++https://www.forescout.com/wp-content/uploads/2018/04/CounterACT_Syslog_Messages_Technical_Note.pdf +++Supports logs from "NAC Events", "Threat Protection", and "System Log and Events" sections. +++Does not support logs from "User Operation" or "Operating System Messages" sections (too much variance between systems). +If you are looking to use the ForeScout CounterACT API, please use this add-on: https://splunkbase.splunk.com/app/3382/