/StormshieldAppforSplunk

Stormshield Network Security App for Splunk

Primary LanguageShellBSD 3-Clause "New" or "Revised" LicenseBSD-3-Clause

Stormshield Network Security App for Splunk

Stormshield Network Security App for Splunk provides dashboards, visualizations and reporting for Stormshield security appliances.

Installation

Install from the splunkbase:

https://splunkbase.splunk.com/app/2918/

Or copy the project folder in the directory $SPLUNK_HOME/etc/apps/ of your splunk server.

Create a Syslog TCP or UDP connector, use an index named 'sns':

  • Navigate to Settings -> Data Inputs -> UDP or UDP -> Add new
  • Set the UDP port (default port is 514)
  • Source type: select syslog
  • Index: create a new index 'sns'

Configure your Stormshield Appliances to send their logs via syslog to the Splunk server.

Usage

Launch the application from the Splunk homepage.