How to get forwarded logs from Splunk to RSA Netwitness Collector

[Deepakshukla]

Hi,

Can anyone please help me with the approach and challenges to get the forwarded logs from Splunk to RSA Netwitness. Let's assume log sources are Checkpoint, Windows Server, DHCP server, Switches n Routers, Database, IPS/IDS..

[LisaTiernan]

Hello Deepak, RSA University has a course on NetWitness and Splunk integration. Here is a link to the course description if you are interested:

RSA NetWitness Network and Splunk® Integration  

You could look at the description and see if it is what you are looking for. The course is based on NW 10.6. 

[EricPartington]

https://community.rsa.com/docs/DOC-61797

Splunk integration guide

[Deepakshukla]

Thanks Lisa.!!

Will go through once organization approve this.

[Deepakshukla]

Thanks Eric for the document, however I already have it.

Have gone through with the document and have set of queries.

We are planning to forward the desired events preserving raw log from Splunk through Syslog UDP-514.

Didn't understand the exact limitation mentioned in page-15.

Step-2: Configure Splunk to point RSA.

Mentioned parameters are really not clear, would like to more in detail.

Use the integration.

This step describes how to view logs from Splunk to RSA.

Would like to more in-detail the challenges and changes which needs to be done at RSA NW end.

Would love to hear from you on this....

[DaveGlover]

Deepak

Try the following on your indexer

----------------------------------------------------------------

# props.conf

[host::*]
TRANSFORMS-rsa = rsa_format_1, send_to_rsa
SEDCMD-newlines = s/[\n\r]+/ /g  # I do not know if this is still required.

# transforms.conf

[rsa_format_1]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.*)$
FORMAT = [][][$1][0000][] $0
DEST_KEY = _raw

[send_to_rsa]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = rsa_syslog

# outputs.conf

[tcpout:rsa_syslog]
server = <ip>:514
sendCookedData=false

----------------------------------------------------------------------

keep in mind that parsing might be an issue for Windows and a few other devices.  

Dave

[Deepakshukla]

Thanks for your valuable inputs Dave.

But still it's not working. Getting below message in splunk GUI.

Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group rsa_syslog has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data