Forwarding Snort Live Logs To Splunk.

To forward live snort logs to Splunk we need to follow 4 main step as below.

1) Splunk Port Configuration.
2) Firewall Setup.
3) Download Splunk Forwarder in Kali.
4) Step to forward snort live log to Splunk.

1)Splunk Port Configuration

Step 1:- Go to https://www.127.0.0.1:8000

Step 2:- Click on Setting And Select "Add Data" And Then Select "Forwarding & Receiving".

 

Step 3:- In Receiving Data Click On "Configure Receiving".

 

Step 4:- And Add Port Number 9997. 

        {9997 is Default Splunk Port Number}

Now You Can See Successfully We Added Receiving Port .

Step 5:- click on Apps and then select on "Find More Apps".

 

Step 6:- search snort and then install "Snort Alert For Splunk".

step 7:- It will ask you to username and password use same username and password as Splunk, and then click on "Login and Install".

2)Firewall Setup

Step 1:- Then Go To Windows Control Panel and Open Windows Firewall.
 

Step 2:- Click On "Advance Settings".

 

Step 3:- Click On "Inbound Rules" And Then Click On Click On 'New Rules".
 

Step 4:- "Rule Type" Page Will Open Click On "Port" And Then Click On "Next" Button.
 

Step 5:- Select "TCP" And Specified Port "9997" And Then Click On Next Button.

        {9997 is Default Splunk Port Number}

 

Step 6:- Allow The Connection And Click On "Next" Button.
 

Step 7:- Click On "Next" Button.
 

Step 8:- Give "Name" Of Rules And Click On "Finished" Button.

 

Now You Can See The Created Rule.

 

3) Download Splunk Forwarder in Kali.

Step 1:- Go to https://www.splunk.com

Step 2:- Download Splunk Universal Forwarder Using Your Old User Name And Password.

 

4) Forwarding Snort Logs To Splunk.

Step 1:- Move Splunk Forwarder into /opt/ Using mv Commend.

        mv splunkforwarder-8.2.2-87344edfcdb4-linux-2.6-amd64.deb /opt/

 

Step 2:- Install Splunk Forwarder Using This Commend.

        apt install ./splunkforwarder-8.2.2-87344edfcdb4-linux-2.6-amd64.deb 

        (file name of splunk forwarder)
 

Step 3: write below commands in terminal.

  ls

  cd splunkforwarder

  ls

  cd bin

 ./splunk start --accept-license

It will ask for username and password use your username and password same as spunk login username n password.

 

Step 4:- Write following command on terminal.

     ./splunk add forward-server 192.168.0.107:9997 

       write IP address as your windows system IP address and port as your Splunk port

Step 5:- write below commands in terminal.

cd ..

ls

cd etc

ls

cd system

ls

cd local

vi outputs.conf

outputs.conf file will open. in this file write following.

     [tcpout]
      defaultGroup = default-autolb-group
      [tcpout-server://192.168.0.107:9997]
      [tcpout:default-autolb-group]
      server = 192.168.0.107:9997,127.0.0.1:9997
      [tcpout-server://192.168.0.107:9997]  {your system(windows) ip address}
      [tcpout-server://127.0.0.1:9997] {your splunk browser ip address}

Step 6:- write following Command to monitor Snort log.

      sudo ./splunk add monitor /var/root/auth.log -sourcetype linux_secure

     sudo ./splunk add monitor /var/root/syslog -sourcetype syslog

       sudo ./splunk add monitor /root/log/snort.alert.fast

      sudo ./splunk add monitor /root/log/snort.alert

      sudo ./splunk add monitor /root/log/snort.log.1629974293

Step 7:- write below commands in terminal

     cd ..

    cd etc

    ls

    cd apps

    ls

    cd search

    ls

    cd local

    ls

    vi inputs.conf

inputs.conf file will open. in this file write following.

  [splunktcp://9997]
        connection_host = ip {Add IP address of your splunk browser}
        [monitor:///root/snort/]
        disabled = false
        index = main
        sourcetype = snort_alert_full
        source = snort

Step 8 : write below command.

./splunk restart

Step 9: In Splunk click on "Search & Reporting".

and then click on "Data Summary".

Now you can see live logs of snort in splunk.