Ingesting Delinea Audit/event Logs into Elasticsearch

[tthiry (Tony Thiry)]

Hello,

I am wondering if anyone has tried ingesting Delinea Secret Server logs into Elasticsearch. I'm not quite sure where to start. We are using the cloud version of both Elastic and Delinea.

Any helpful hints would be appreciated.

Thanks,
Tony

[warkolm (Mark Walkom)]

Are you asking on how to ingest them using a pipeline in Elasticsearch (ie using grok)?

Can you share an example message?

[tthiry (Tony Thiry)]

Hello Mark,

No, I am not asking how to parse the data but rather how to get the data out of Delinea. It's not clear to me how to extract it. Is it the syslog configuration or will I need to use an API and a scheduled task to run a series of reports?

Thanks,
Tony

[warkolm (Mark Walkom)]

You'd need to ask those more familiar with that product, we don't know it sorry.

[leandrojmp (Leandro Pereira)]

@tthiry

Is it the syslog configuration or will I need to use an API and a scheduled task to run a series of reports?

You need to check in the documentation for Delinea or with the support of the tool as your question is not related to any Elastic tool.