Imperva Cyber Community

communities_1.jpg
Β View Only

  • 1.  Splunk server not receiving any events for audit and security from the DAM gateway

    Posted 22 days ago
    Edited by Agustin Cudiamat 22 days ago

    Hi Guys,

    I have configured the action set for my Security, Audit and system events to forward the events to my splunk vip.

    Action Sets Settings:

    Protocol: TCP

    Primary host: x.x.x.x

    Primary port: 514

    Syslog Log level: INFO

    I have set the followed action on Security and system policies towards to the following action set as well and Audit policies under external logger towards to the action set.

    The only event i received is my system events from the DAM gateway. Only Security and Audit events are not showing in my splunk server.

    DAM MX and GW is on version 14.16.1.10_0

    Anybody have an idea on this or do i need to check my configuration further in mx side or splunk side?

    #DAM

    #AllImperva

    #databaseactivity

    #Datasecurity


    #DatabaseActivityMonitoring

    ------------------------------
    Agustin Cudiamat
    Engineer
    Singapore
    ------------------------------



  • 2.  RE: Splunk server not receiving any events for audit and security from the DAM gateway

    Posted 22 days ago
    Edited by Mitesh Mehta 22 days ago

    Hello Agustin Cudiamat,

    Please change the protocol from TCP to UDP and try.


    The default protocol for sending syslogs is UDP, typically using port 514.





    ------------------------------
    Regards,
    𝐌𝐒𝐭𝐞𝐬𝐑 𝐌𝐞𝐑𝐭𝐚
    Senior Security Consultant
    Mumbai
    ------------------------------

    Original Message


  • 3.  RE: Splunk server not receiving any events for audit and security from the DAM gateway

    Posted 22 days ago

    Hi Mitesh,

    Will try and test it out.

    Thanks!



    ------------------------------
    Agustin Cudiamat
    Field Engineer
    Singapore
    ------------------------------

    Original Message


  • 4.  RE: Splunk server not receiving any events for audit and security from the DAM gateway

    Posted 21 days ago

    Hi Agustin, 

    It is a strange case that the settings presently configured work for System Events, but not for Security Events or Violations.

    Please check Action Interface Types and Action Set Event Types (https://docs.imperva.com/bundle/v14.19-dam-user-guide/page/2403.htm) that you used.

    For example, Action Set Event Type = System Events and Action Interface Type = Log System Event to System Log (syslog) using the CEF standard. Similarly, Action Set Event Type = All - Security Violations and Action Interface Type = Log to System Log (Syslog). For both cases, kindly use appropriate CEF Message Format.

    Regards,



    ------------------------------
    SBISOC 4430
    Manager
    Mumbai
    ------------------------------

    Original Message