{"id":2884,"date":"2022-03-15T20:46:54","date_gmt":"2022-03-16T04:46:54","guid":{"rendered":"https:\/\/tungle.ca\/?p=2884"},"modified":"2022-05-04T06:47:41","modified_gmt":"2022-05-04T14:47:41","slug":"send-palo-alto-fortigate-cisco-router-and-linux-server-logs-to-splunk","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=2884","title":{"rendered":"Send Palo Alto, FortiGate, Cisco Router, and Linux Server logs to Splunk"},"content":{"rendered":"\n

This is a diagram that I have used to deploy this lab.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Log in to Splunk, and download Cisco Suite for Splunk, Fortigate, and Palo Alto app for Splunk.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click Install app from file.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

On Splunk.<\/p>\n\n\n\n

+ Palo Alto<\/p>\n\n\n\n

Go to Settings – Data inputs – New Local UDP.<\/p>\n\n\n\n

Enter the port 5514 on the Port setting<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Source type: pan_log<\/p>\n\n\n\n

App Control: Palo Alto Networks<\/p>\n\n\n\n

Method: IP<\/p>\n\n\n\n

Index: Default<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

On Palo Alto, configure to send logs to Splunk server with destination port is 5514.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"
Commit, log off and log on to generate logs.<\/figcaption><\/figure>\n\n\n\n

Back to Splunk.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click Palo Alto App – Operations – Real-time Event Feed.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

+ Cisco Router R1.<\/p>\n\n\n\n

conf t\nlogging trap informational\nlogging host 142.232.197.8 transport udp port 5515 <\/code><\/pre>\n\n\n\n
On Splunk.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Port 5515<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Source type: cisco:asa<\/p>\n\n\n\n
App Context: Cisco Suite for Splunk<\/p>\n\n\n\n
Method: IP<\/p>\n\n\n\n
Index: default.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Back to Router, send sample logs to Splunk.<\/p>\n\n\n\n
end\nsend log \"Tung Le\"\nsend log \"Tung Le\"<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ On Kali Linux.<\/p>\n\n\n\n
sudo su\nnano \/etc\/rsyslog.conf\n##Add the following line to the end of the file. The listening port is 5516.\n*.*                @142.232.198.8:5516<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Restart rsyslog service.<\/p>\n\n\n\n
systemctl restart rsyslog\nsystemctl status rsyslog<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Back to Splunk, configure the listening port for the Linux server is 5516<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
source type: Syslog<\/p>\n\n\n\n
app context: Apps Browser<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Back to Kali, type the command below to generate logs to Splunk.<\/p>\n\n\n\n
logger \"Tung Le\"<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ FortiGate:<\/p>\n\n\n\n
Configure FortiGate to send logs to Splunk via the UDP port 5517.<\/p>\n\n\n\n
config log syslogd setting\nset status enable\nset server 142.232.197.8\nset port 5517\nend <\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Log into FortiGate, and enable the setting below to send logs to Splunk.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
On Splunk, configure port is 5517.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Source type: fgt_log<\/p>\n\n\n\n
App Context: FortiGate <\/p>\n\n\n\n
Method: IP<\/p>\n\n\n\n
Index: Default<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Log off FortiGate, type w wrong password to generate logs.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
This is a diagram that I have used to deploy this lab. Log in to Splunk, and download Cisco Suite for Splunk, Fortigate, and Palo Alto app for Splunk. Click Install app from file. On Splunk. + Palo Alto Go to Settings – Data inputs – New Local UDP. Enter the port 5514 on the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,3,6,21,11],"tags":[15,14,18],"class_list":["post-2884","post","type-post","status-publish","format-standard","hentry","category-cisco","category-fortigate","category-linux","category-palo-alto","category-security","tag-cisco","tag-fortinet","tag-palo-alto"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2884"}],"version-history":[{"count":4,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2884\/revisions"}],"predecessor-version":[{"id":3334,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2884\/revisions\/3334"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}