Kaspersky Add-on for Splunk

System requirements

Kaspersky Security Center 8 or newer
Splunk 7.1 or newer

Installation

Install the add-on on:
Search Heads - The add-on contains search time extractions
Indexers - Needed for index time operations in case the syslog flow is targetting this instances
Heavy Forwaders - Needed for index time operations in case the syslog flow is targetting this instances

Configuration

Splunk

Configure a new index (e.g. epav) for the new logs

Receiving syslog on Splunk

NOTE: Its recommended to use a separate and dedicated syslog solution (e.g. rsyslog, syslog-ng, etc)
- Configure new UDP port (e.g. 514) pointing to the new index using the "kaspersky:leef" sourcetype

Monitoring log files

Configure a new file monitor input pointing to the new index using the "kaspersky:leef" sourcetype

Kaspersky Security Center

Configure syslog outputs
For more information please refer to the Kaspersky documentation.

Troubleshooting

Support

You can file bug reports on our GitHub issue tracker and they will be addressed as soon as possible.
Support is a volunteer effort and there is no guaranteed response time.

Online documentation

http://ta-kaspersky.readthedocs.org

Kaspersky Add-on for Splunk

0