Splunk Universal Forwarder to DataBee

Overview

The following deployment architecture diagram shows how logs can be forwarded from a log source to DataBee using Splunk Universal Forwarder (UF) or Splunk Heavy Forwarder (HF).

Architecture: a data source sends logs to a Splunk Universal or Heavy Forwarder, which forwards them over TLS to a TCP feed on the DataBee data collector, which sends them to the DataBee platform

Prerequisites

Splunk Forwarder (UF/HF)
DataBee Data Collector (Configure a TCP feed)
DataBee UI Access

Splunk Configurations

Contact your Splunk admin to configure sending logs from Splunk Forwarder (UF/HF) to the data collector. Ref: Forward data to third-party systems.

Note

This will also forward Splunk internal logs. You can optionally disable it with the help of your Splunk Admin.

Example

The following example illustrates the method for sending logs from a data source (such as ISC Bind) to Splunk using UF/HF and outlines the general procedure for disabling Splunk's internal logging before sending logs to DataBee via data collector.

Example: ISC Bind sends logs to the Splunk forwarder on port 8888, and the forwarder sends them over TLS to the data collector TCP feed on port 6666

The steps mentioned below are the same (unless explicitly stated otherwise) for users who want to use Splunk HF instead of UF.

Step 1: Receiving data on Splunk

Configure the data source (Refer to the relevant vendor documentation) to send data to Splunk Forwarder on one of the open ports.
On your Splunk environment:
1. Set the input stanza in $SPLUNK_HOME/etc/system/local/inputs.conf (in case you’re using Splunk UF) and $SPLUNK_HOME/etc/apps/search/local/inputs.conf (in case you’re using Splunk HF) to receive data sent from the configured data source.
2. Alternatively, for Splunk HF, you can configure receiving from Splunk Web (UI) also. Ref: Configure receiving from the UI.
3. Create the inputs.conf file, if it is not present in any of the above-mentioned locations.
  For example, the below stanza receives the data from the configured data source on port 8888 using TCP. Choose a port that is not already in use. Avoid 8000 and 8089, which Splunk uses by default for Splunk Web and the management port.
```
[tcp:8888]
disabled = false
```

Step 2: Disabling Splunk internal logs

Locate the inputs.conf file, which is usually found in $SPLUNK_HOME/etc/system/local/ or $SPLUNK_HOME/etc/apps/<app-name>/local/. You can comment out or remove the stanzas related to Splunk's internal logs. These might look like:
```
[monitor://$SPLUNK_HOME/var/log/splunk]
disabled = true
```
In this example, setting disabled = true will stop the Splunk forwarder (UF/HF) from monitoring and forwarding its log files.
Similarly, check outputs.conf for any configurations that are forwarding to third-party systems and adjust them accordingly.

Step 3: Sending data to the Data Collector

Before configuring the Splunk environment, create a collector and configure a TCP data source for your desired product on DataBee. Install the data collector on your system with the desired port (Make sure the port is open to receive the data).
On your Splunk environment:
1. Copy the certificates from the data collector and place them under the following path: $SPLUNK_HOME/etc/auth/crl/. Only PEM-formatted certificates are supported.
2. Configure the output stanza in $SPLUNK_HOME/etc/system/local/outputs.conf to forward data from Splunk Forwarder (UF/HF) to the TCP data source configured on the Data Collector. Ref: Configure forwarders with outputs.conf.
  For example, the below configuration sends the data to the data collector on port 6666. Replace <data-collector-host> with the IP address or hostname of the system where the data collector is installed, and 6666 with the port of your TCP data source.
```
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = <data-collector-host>:6666
sendCookedData = false
useSSL = true
sslVerifyServerCert = true
sslRootCAPath = $SPLUNK_HOME/etc/auth/crl/ca_cert.pem

[tcpout-server://<data-collector-host>:6666]
```
  Note:
  If you forward more than one data source, each data source needs its own TCP data source and port on the data collector. On the Splunk Forwarder (UF/HF), create a separate output group for each data collector port, and route each input to its group with the _TCP_ROUTING setting, as shown in the example below.
  For example, the following configuration sends ISC Bind data to port 6666 and firewall data to port 6667 on the data collector.
  inputs.conf
```
[tcp:8888]
disabled = false
_TCP_ROUTING = databee-bind

[tcp:8889]
disabled = false
_TCP_ROUTING = databee-firewall
```
  outputs.conf
```
[tcpout:databee-bind]
server = <data-collector-host>:6666
sendCookedData = false

[tcpout:databee-firewall]
server = <data-collector-host>:6667
sendCookedData = false
```
  Add the same SSL settings shown in the earlier example to each output group.
Restart Splunk.
```
$SPLUNK_HOME/bin/splunk restart
```

For further help, contact your Splunk admin.

Splunk Notables & Alerts

The Splunk Notables and Alerts integration lets security teams forward notable events and alerts from Splunk to DataBee. For its architecture and configuration, see Splunk Notables & Alerts.

Microsoft Sentinel

Microsoft Sentinel is a cloud-native security information and event management (SIEM) service that helps you detect, prevent, and respond to security threats across your organization. For configuration steps, see Microsoft Sentinel.