Splunk HEC¶
Use Splunk HTTP Event Collector when centralizing VNetArmor events in Splunk.
Recommended source metadata¶
| Field | Example |
|---|---|
| sourcetype | vnetarmor:json |
| index | security |
| source | vnetarmor-core |
Example search ideas¶
sourcetype="vnetarmor:json" action=BLOCK
sourcetype="vnetarmor:json" module=waf | stats count by rule_id
sourcetype="vnetarmor:json" status>=500 | stats count by backend