Skip to main content
Lantern Home

 

Splunk Lantern

Getting data onboarded to Splunk Enterprise Security

  1. Last updated
  2. Save as PDF

After identifying your use cases, the next step is to get your data onboarded. Splunk Enterprise Security (ES) requires that all data sources comply with the Splunk Common Information Model (CIM), which normalizes the field names that detections need to correlate events. After your security data is sent into a Splunk deployment to be indexed, you can correlate events from disparate data sources across time and identify complex behavior that could be malicious.

Data source planning for Splunk Enterprise Security has detailed configuration information for add-ons and other data input components.

To get data into ES, follow these steps:

  1. Identify the data source required.
  2. Identify and install the technical add-on required.
  3. Configure the corresponding server, device, or technology.
  4. Customize the add-on where necessary.
  5. Set up a data input in the Splunk platform and confirm the source type settings.

Using the add-ons gives you CIM-compliant data going into a Splunk deployment. If you need to validate or troubleshoot your data, see Use the CIM to validate your data. The CIM add-on is normally included with the ES installation.

The terms "add-on" and "TA" are often used interchangeably. However, they are different from an app.

  • An add-on (TA) is a type of app that provides specific capabilities to apps, such as getting data in, mapping data, or providing saved searches and macros. An add-on is not typically run as a standalone app. Instead, an add-on is a reusable component that supports other apps across a number of different use cases.
  • An application (app) typically addresses several use cases. An app contains one or more views. An app can include various knowledge objects such as reports, lookups, scripted inputs, and modular inputs. An app sometimes depends on one or more add-ons for specific capabilities.

You can download the TAs needed to send data into a Splunk deployment to drive your use cases. There are currently over 1,400 security-related apps and add-ons on Splunkbase that support security products from Cisco, McAfee, CrowdStrike, Zscaler, and many others. Examples of commonly used TAs include:

Syslog

Syslog is a technology frequently used, and considered a best practice, when collecting data from security devices such as firewalls and security appliances. You can set up a syslog server to collect data from its sources, and then forward it from the syslog server to a Splunk deployment. Further considerations with syslog are documented in Splunk Validated Architectures.