Configuring the Threat Events Stream for Splunk via Syslog

Jamf Protect Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
Requirements

  • Administrator permissions for Splunk

  • SSL/TLS certificate for the Splunk server to communicate securely with the Threat Events Stream. For more information, see the Common CA Database.

  • A public DNS hostname linked to the Splunk server

  • Administrator permission to modify firewall settings (if applicable)

  1. Modify the inputs.conf file as described in the Splunk Enterprise Admin Manual from Splunk.

    The following code block is an example of the inputs.conf file. You can use this as a reference when editing your file:

    [tcp-ssl://8888]
connection_host = ip
index = wandera
source = WanderaThreat
sourcetype = syslog
disabled = 0

[SSL]
serverCert = C:\Program Files\Splunk\etc\auth\mycerts\tcpinputserver.pem

    In this example, Splunk will listen on TCP port 8888 for encrypted data. The SSL stanza is necessary to force the use of the server certificate.

  2. Restart Splunk and verify that there are no errors in splunkd.log.
  3. Configure the firewall to allow external connections to the configured Splunk TCP port from the Threat Events Stream IP addresses.

    The IP addresses can be found under Advanced Settings on the Threat Events Stream configuration page.

  4. In Jamf Security Cloud, navigate to Integrations > Data Streams.
  5. Select Threat Events Stream.
  6. Select "Syslog" as the Streaming Target.
  7. Add the Server Hostname/IP and the Port configured for your Splunk instance.
  8. Click Test Configuration.
  9. If the test is successful, you can enable the Threat Events Stream with the toggle button.
  10. Click Save.
The detected threats are sent to your Splunk instance in real time.

The Splunk Log (splunkd.log) error "Can't read key file" may appear if you have the server certificate and key in two separate files. This can be fixed by combining the cert and key into one using the following terminal command (on example files server_cert.pem and server.key):