This TA takes Suricata5 data from your port mirrored Suricata server and makes it readable within Splunk. See Cheatsheets on how to setup a Suricata Port Mirrored Server
security splunk suricata siem network-security-monitoring splunk-http network-security splunk-enterprise splunk-application security-dashboard splunk-universal-forwarder splunk-sdk splunk-searches splunk-hec security-monitoring splunk-alerts splunk-addon splunk-impact-cloud security-alerts splunk-security
-
Updated
Sep 5, 2020