The data is created as wordfence detects attack patterns on the website itself. It is then transferred to the splunk HTTP Event Collector (HEC). There it can be correlated with other security information relevant for your organization or its processes.
The ingestion via python skript + HEC does work even for *-as-a-service offerings, where you are not allowed to work with the splunk universal forwarder.
The wfence App for Splunk provides customizable, out-of-the-box alerts and dashboards to visualize attack data in Splunk, announcing critical situations such as: * missing patches * Potential administrator login takeover * Brute force attacks on the login pages * Potential integrity loss on the website * attack distribution patterns over certain users over time
The distribution of attacking clients based on IP Geolocation services has to be monitored.
Show, don't tell: many splunk Apps just don't show the dashboards in action. To show the apparently critical situations, a demo dashboard is provided, which is used to verify the current installation.
Version 0.0.3
-wfence logo by Defiant Inc replaced by copyright free image
-readme adapted
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.