Trend IMSVA Add-on for Splunk provides CIM compliant field extractions and data enrichment for your Trend InterScan Messaging Security (IMSVA) data.
1.0.0: October 2019
The add-on provides field extractions and data enrichment for both 'Policy events' and 'Message tracking' IMSVA data.
'Policy events' provide details on the filtering process while 'Message tracking' data provides insight on the final action taken by the virtual appliance.
While IMSVA supports syslog since version 9.1 this add-on has been actually developed before syslog option was available and relies on having the Splunk Universal Forwarder deployed on the IMSVA and directly monitoring the files.
Although having the Universal Forwarder deployed on the virtual appliance worked pretty well for us but you have to consider that it might not an option the vendor would recommend and even less support.
So far, we did not have the chance to test syslog option.
Install the Add-on on your Splunk platform.
For distributed environments, the Add-on needs to be deployed on the on Indexer(s) as it includes parsing configuration parameters.
IMSVA data should be indexed under both 'trend:imsva:polevt' and 'trend:imsva:msgtra' sourcetypes using these monitoring stanzas:
[monitor:///opt/trend/imss/log/msgtra.imss.*] sourcetype = trend:imsva:msgtra index = index [monitor:///opt/trend/imss/log/polevt.imss.*] sourcetype = trend:imsva:polevt index = index
Do not hesitate to check provided log samples to make sure your indexed data matches data used to build this Add-on.
With support's help, we did our best to understand and extract as many fields as we could but as the logging format is not fully documented, there might be a few field extractions missing.
If you have more info on the missing fields, please share with us and we will improve the add-on.
If you opt for the syslog option, this add-on is not compatible yet but feel free to provide an anonymized sample so we can work on that.
- Initial release
Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.