Getting pfSense/Suricata Logs into Splunk

Below lays out my adventures setting up syslog-ng as a pfSense package to get pfSense (&/or Suricata - the same process can be applied, see &#xA; the very helpful guide here ) logs into a Splunk (Cloud) instance! &#xA; &#xA; Pre-requisites: &#xA; Change the logging format on pfSense from the default BSD log message format to the syslog (RFC5424) format . Enables extra info like hostname, etc. to…