Jan 22 2020 12:18 AM
Team please confirm whether Splunk logs can be send on Azure Sentinel if yes how and where we can see the logs.
Jan 22 2020 02:27 AM
Most customers, send the data (in my experience) from the source to one or both SIEM tools, rather than SIEM to SIEM - for which both have APIs you can use.
Jan 26 2020 11:40 AM
Solution@Anurag65 , @CliveWatson : we do see customers who prefer to reuse their existing collection infrastructure and hence send logs from a current SIEM to Sentinel. Splunk specifically supports forwarding events in CEF using the Splunk CEF app. You can also forward directly from a forwarder using Syslog.
Feb 07 2020 10:15 PM
@Ofer_Shezaf I'm more interested in seeing it go the other way, how can I send the Sentinel Alerts to Splunk?
Feb 09 2020 12:22 AM
@David Caddick: Either use the Graph Security API or A logic App playbook. The former is more straight forward, but the letter allows more control. For example you will be able to get the back events with the alert.
May 03 2020 10:46 PM
@Ofer_Shezaf
Hi there. I am working my way thru the Sentinel Ninja training in preparation for being involved in a Sentinel PoC where the client wants to use their existing SPLUNK data collection as the source for Sentinel rather than establish new collector agents or even to forward from their existing collector agents.
Can you point me to any detailed explanation of the steps involved at both ends (Splunk & Azure) to get the data transfer established, so as to best showcase the strengths of Sentinel?
Most frequently the discussions are about getting data from Azure INTO Splunk not the other way round.
Is there any way for Sentinel to access the collected raw data direct from Splunk as it seems that the CEF connector will present a filtered view of the events ... or am I missing the point?
Having read thru the following:
https://docs.microsoft.com/bs-latn-ba/azure/sentinel/connect-common-event-format
and
https://docs.splunk.com/Documentation/CEFapp/2.3.0/DeployCEFapp/AboutSplunkAppforCEF
It would be great to see a worked use case of this Sentinel enrichment implementation.
May 03 2020 11:53 PM
@AutomationMan : I don't have a detailed guide on the topic, though it is a worthwhile topic to add to our list. As to the solution:
~ Ofer
May 06 2020 07:48 PM
Jun 10 2020 10:59 AM
@AutomationMan i just finalised an integration to be able to export any data from splunk index to sentinel. I will share it as soon possible.
Dec 08 2021 10:39 AM
@yokhaldi can you please share the details on how did you get logs from Splunk to Sentinel? Did you utilize the CEF to forward to Sentinel log collector or directly to Sentinel using HTTP event API?
Jan 26 2020 11:40 AM
Solution@Anurag65 , @CliveWatson : we do see customers who prefer to reuse their existing collection infrastructure and hence send logs from a current SIEM to Sentinel. Splunk specifically supports forwarding events in CEF using the Splunk CEF app. You can also forward directly from a forwarder using Syslog.