Description

We send CEF/Syslog events to Splunk over UDP.  This article explains how to configure Splunk to receive events from JATP.

Solution

Configuration of Splunk: 

  1. Splunk Home -> Data -> Add Data -> Choose a Data Source -> From a UDP port.
    Then you will see an "Add New" page.

  2. Enter the following:
    UDP port : 514
    Source Name Override : leave it empty
    Set Source type : Manual
    Source type : You can enter CEF/Syslog

  3. Click Save

  4. Go to Data Inputs -> UDP to verify the config has been enabled.

Configuration of JATP:

  1. Config -> Notifications -> SIEM Settings

  2. Click Add New SIEM Connector

  3. Select the appropriate data type and format. Syslog and CEF are both supported. However, CEF format is preferred.

  4. Enter the hostname as your Splunk server and the port number as 514.


Note: Only events which are generated after the SIEM configuration will be pushed to Splunk. For example, if you detected any malwares at 10:00 and you configure a SIEM entry at 11:00, you will not receive alerts for the old malwares.