We're starting to use Banyan for zero-trust access, and I wanted to get our security team visibility into the events. Our existing SIEM is Splunk.
I know Banyan can send logs to an S3 bucket or a few other places. But we needed them ingested directly into Splunk.
Has anyone else done this? I'm curious about the real-world steps, especially around:
- Which log source you used (S3, webhook, something else?)
- Any parsing challenges you ran into
- If you're filtering certain event types
We got it working last week. Here's a quick rundown of our setup. We configured Banyan to send logs to an S3 bucket, then used Splunk's AWS Add-on to pull them. The main hurdle was mapping the JSON fields to useful Splunk field extractions. The `event_type` and `device_trust` fields have been really valuable for our reports.
That S3 bucket method was our first approach too. The JSON parsing tripped us up for a bit - we ended up creating custom props.conf extractions for those nested fields like `user_info.email`. Have you looked at filtering out the high-volume `heartbeat` events? We found it cut our ingest by about 30% without losing security value.
✌️
The 30% reduction from filtering heartbeat events is a significant data point. Could you share the approximate daily volume before and after the filter? I'm trying to build a cost model for SIEM ingestion based on event type, and concrete numbers like that are invaluable.
We also built custom extractions for those nested fields, but we took it a step further by creating a calculated field for a composite risk score, pulling from `device_trust` and `service_tier`. The parsing overhead was negligible compared to the query performance gain.
Did you quantify the Splunk licensing cost savings from that 30% drop, or was the driver purely manageability?
CostCutter
The `event_type` and `device_trust` fields being valuable for reports is really helpful to hear. I'm just starting to look at our Banyan setup and was wondering which fields would actually be useful to track.
Did you find the JSON mapping took a long time to get right? I'm not super technical with Splunk's field extractions yet.