#Splunk forwarder port install#
#Splunk forwarder port windows#

Click “Customize Options” as shown in Figure 55. On the Data Protection Advisor application server, execute the MSI file to start the installation.Ĭheck the box to accept the “License Agreement” and choose the option “An on-premises Splunk Enterprise instance”.

#Splunk forwarder port install#

Successful receiving port configuration Install the Splunk universal forwarder on Data Protection Advisorĭownload the Splunk universal forwarder from and copy it to the Data Protection Advisor application server. Section to input the receiver portįigure 54 shows successful receiving port configuration from the Splunk UI.įigure 54. The conventional receiver port configured on indexers is port 9997.įigure 53. Forwarding and receiving configurationĮnter the port as “9997” in the “Listen on this port” section as shown in Figure 53. Forwarding and Receiving option in settingsĪs shown in Figure 52, in the “Receive data” section, click “Add new” next to the “Configure receiving” option.įigure 52. To enable the receiver, from the Splunk web UI, navigate to “Settings” and select “Forwarding and Receiving” as shown in Figure 51. Section to apply analysis policy to groups, objects, and child objects Configure a receiving port from the Splunk Web UIĪ receiver is the Splunk instance that receives data from the forwarder. In this example as shown in Figure 50, the analysis policy is applied to object “PowerProtect Data Manager Software”įigure 50. If enabled simultaneously, you may be flooded with alerts.Īpply the analysis policy to groups, objects, and child objects respectively. Note : When creating an analysis policy, it is recommended to start with one rule and build the policy. Policy-based action configuration in an analysis policy Sample analysis policy for Cyber threat anomaly detectionįigure 49. Add/remove analysis rule configurationĪs an example, a sample analysis policy “Cyber Threat Anomaly Detection” is created with analysis rules and policy-based action as shown in Figure 48 and Figure 49. In the Analysis Rules, select “ADD/REMOVE RULES” to add the analysis rules as shown in Figure 47.

#Splunk forwarder port windows#

In the policy-based actions, select “EDIT POLICY-BASED ACTIONS” and enable the event log action “Write an event to the Windows Event Log” as shown in Figure 46. Creating analysis policy in Data Protection Advisor UI Query the Splunk main index for events forwarded from Data Protection AdvisorĬonfigure analysis policy on Data Protection Advisor with rules and actionsįrom the Data Protection Advisor UI, navigate to “Policies” and select “CREATE POLICY” to create an analysis policy with analysis rules and policy-based actions as shown in Figure 45.Install the Splunk universal forwarder on Data Protection Advisor.Configure a receiving port from the Splunk Web UI.

Create and configure Analysis Engine policy with rules on Data Protection Advisor.

High-level procedure to integrate Data Protection Advisor with Splunk