stormshield / StormshieldAppforSplunk

Stormshield Network Security App for Splunk

Stormshield Network Security App for Splunk

Stormshield Network Security App for Splunk provides dashboards, visualizations and reporting for Stormshield security appliances.

Installation

Install from the splunkbase:

https://splunkbase.splunk.com/app/2918/

Or copy the project folder in the directory $SPLUNK_HOME/etc/apps/ of your splunk server.

Create a Syslog TCP or UDP connector, use an index named 'sns':

• Navigate to Settings -> Data Inputs -> UDP or UDP -> Add new
• Set the UDP port (default port is 514)
• Source type: select syslog
• Index: create a new index 'sns'

Configure your Stormshield Appliances to send their logs via syslog to the Splunk server.

Usage

Launch the application from the Splunk homepage.