Proofpoint Protection Server
Key facts
- Requires vendor product by source configuration
- Legacy BSD Format default port 514
- NOTE: This filter will simply parse the syslog message itself, and will not perform the (required) re-assembly of related
messages to create meaningful final output. This will require follow-on processing in Splunk.
Links
Sourcetypes
Sourcetype and Index Configuration
Parser Configuration
#/opt/sc4s/local/config/app-parsers/app-vps-proofpoint_pps.conf
#File name provided is a suggestion it must be globally unique
application app-vps-test-proofpoint_pps[sc4s-vps] {
filter {
host("pps-*" type(glob))
};
parser {
p_set_netsource_fields(
vendor('proofpoint')
product('pps')
);
};
};