For better parsing of Kaspersky Scan Engine events in CEF format, install CEF Extraction Add-on to your Splunk instance.
To configure Splunk:
Selecting Settings > Data inputs
Adding a new TCP input
Click Next.
Selecting cefevents
You can specify the App Context and Index fields according to your needs. For example, you can specify the index of the events sent by Kaspersky Scan Engine.
After Kaspersky Scan Engine is configured, you can check if the Splunk configuration is correct.
To check if Splunk is configured correctly:
source="scanengine" sourcetype="cefevents"
source="scanengine" sourcetype="syslog"
If Splunk is configured correctly, it displays events sent by Kaspersky Scan Engine in real time.
Events sent by Kaspersky Scan Engine
Page top