splunk
Add_on_Security_Onion
Overview
Details
This Technology Add-on (TA) provides field extractions, event types, tags, and lookups
to normalize Security Onion Zeek and Suricata logs into Splunk Common Information Model (CIM).
It enables better visibility into network security events and integrates seamlessly
with Splunk Enterprise Security.
to normalize Security Onion Zeek and Suricata logs into Splunk Common Information Model (CIM).
It enables better visibility into network security events and integrates seamlessly
with Splunk Enterprise Security.
This add-on provides prebuilt configurations to collect, normalize, and index logs from Security Onion into Splunk. It supports key data sources such as Suricata, Zeek, Wazuh, and other Security Onion components. Key Features:
Preconfigured inputs for Security Onion log types
Field extractions and CIM-compatible tagging
Easy integration with Splunk DB Connect for enriched data analysis
Lightweight, ready-to-use for Splunk Enterprise and Cloud