splunk
Kaspersky Add-on for Splunk
Splunk Cloud
Overview
Details
Kaspersky Add-on for Splunk brings field extractions to Splunk of data generated by Kaspersky Security Center.
Kaspersky Add-on for Splunk
System requirements
- Kaspersky Security Center 8 or newer
- Splunk 7.1 or newer
Installation
Install the add-on on:
Search Heads - The add-on contains search time extractions
Indexers - Needed for index time operations in case the syslog flow is targetting this instances
Heavy Forwaders - Needed for index time operations in case the syslog flow is targetting this instances
Configuration
Splunk
- Configure a new index (e.g. epav) for the new logs
Receiving syslog on Splunk
NOTE: Its recommended to use a separate and dedicated syslog solution (e.g. rsyslog, syslog-ng, etc)
- Configure new UDP port (e.g. 514) pointing to the new index using the "kaspersky:leef" sourcetype
Monitoring log files
- Configure a new file monitor input pointing to the new index using the "kaspersky:leef" sourcetype
Kaspersky Security Center
- Configure syslog outputs
For more information please refer to the Kaspersky documentation.
Troubleshooting
Support
You can file bug reports on our GitHub issue tracker and they will be addressed as soon as possible.
Support is a volunteer effort and there is no guaranteed response time.
Online documentation
Release Notes
Version 0.1.4
April 10, 2020
- App compatibility changed to starting from 7.1.0 due to app.manifest version and Splunk Cloud compatibility
- Improved CIM Change datamodel coverage
- Improved CIM Malware datamodel coverage
- Added missing extractions of signature field for several sourcetypes
Version 0.1.3
Oct. 21, 2019
- Fix issue with the events timezone detection
LEEF format outputs a timestamp in UTC and splunk was detecing it as system default resulting in events in the future for systems in GMT- and in the past for systems in GMT+
Version 0.1.2
Oct. 14, 2019
- Small fixes
- Improvements on some extractions