Eyeglass Solutions Publication

Splunk Soar Integration with Zero Trust Alarms

Home


Overview of Splunk SOAR Solution

  1. Splunk Phantom, renamed to Splunk SOAR, is a security orchestration, automation, and response (SOAR) solution. Security automation involves machine-based execution of security actions to detect, investigate and remediate threats programmatically.  Customers can now leverage the full automation capabilities of a SOAR with Superna Zero Trust API's.


Support Statement

  1. NOTE:  This documentation is provided "as is" without support for 3rd party software.  The level of support for this integration guide is best effort without any SLA on response time.  No 3rd party product support can be provided by Superna directly.  3rd party components require support contracts

Limitations


Solution Overview

Superna Security Edition Zero Trust API is the cornerstone technology used to integrate with SIEM, SOAR and XDR platforms.   Automation begins with data that summarizes the threat and places that information into a security tools to be acted on by Secops and run playbooks to protect corporate IT assets from vulnerabilities and insider or external attackers.   The Splunk Soar platform can act on container events and artifacts that provide details on the incident with all relevant data provided to act on with playbooks and automation cross domain.


What is Splunk SOAR?

Splunk SOAR is a data-centric, modern security information and event management (SIEM) solution that delivers data-driven insights for full-breadth visibility into your security posture so you can protect your business and mitigate risk at scale.


Solution Configuration in Splunk Enterprise and Defender Zero Trust

Prerequisites

  1. Installed Security Edition
  2. Installed Splunk SOAR
  3. Eyeglass OS appliance version 15.5
    1. cat /etc/os-release    


Configuration in Splunk SOAR

  1. Information Needed to complete the Configuration
    1. automation user token
    2. endpoint url of the REST data source application to receive the webhook data
    3. Firewall ports to allow the Eyeglass VM to reach the Splunk Soar endpoint over https port 443
  2. Login to Splunk SOAR application as administrator
    1. Integration requires adding the REST Data Source application from the application from the New apps button
    3. Click the Configure New Asset button
    4. Name the Asset SupernaZT 
    5.   
    6. Click the Asset Settings tab
      1.   
      2. Record the POST Incoming Rest Data Source url that will be used to configure Security Edition zero trust webhooks.
  3. Get the Automation user authentication token
    1. Under the administration menu locate the User management 
    2.  
    3. Edit the automation user
      1. Click the show token button and record the token to be used later in the configuration.
      2. The Allowed IP's field needs to list the subnet or ip address of the Eyeglass VM to allow webhook data to authenticate using the API token. 
      3.  
      4.   
    4. Done
  4. Edit the Superna REST Data handler python code by downloading it from the link below.   This python code allows integration and field mapping from Superna Zero Trust to the Container and artifact objects used within Splunk SOAR event streams.
    1. Click here to download the Superna data handler code.
    2. Open the python file to add your Splunk SOAR ip address, locate this section in the file at the top.
    4. Replace x.x.x.x with the IP address of the Splunk SOAR server that hosts the 
    5. Save the file.
  5. Update the Rest DATA application asset to upload the Custom Python REST handler 
    1.     
    2. click the save button 
  6. done


Configure Defender Zero Trust Webhooks

  1. The next step creates an Zero Trust Webhook URL.    
    1. Configure Zero Trust endpoint in Ransomware Defender Zero Trust tab.
      1. Recommended Configuration: Only Critical and Major events and only the webhooks that set lockout or delayed lockout.   Customers can customize based on specific requirements. The goal is to send findings versus a list of alarms that do not pinpoint a security incident.
      2.   
      3. The endpoint url above will use localhost and will send Webhooks to the application service listening on port 5000. URL to use in the configuration
        1. Add the name Splunk SOAR
        2. paste the REST Data Handler endpoint URL into the URL field 
        3. Add the Content-Type header with value of application/json as shown above to complete the webhook configuration.
        4. Add the custom header ph-auth-token and the automation token captured in the steps above for the value field.
        5. Click save
        6. Click save on the main Webhook configuration page
  2. Test the configuration is working following the next section


How to test the Integration with Splunk SOAR

  1. To test the integration follow these steps
    1. download this curl command template and open with a text editor
      1. locate the very end of the curl command and edit the url and replace the section below with the endpoint recorded above.
        1. "https://172.31.1.246/rest/handler/restdatasource_95e3bcff-bfca-454d-b59e-768da6280c38/supernazt" 
        2. Save the file
    2. Paste the entire cli command to the ssh prompt to send sample data to the running Zero Trust application.  This will send test data directly to the application to be processed and sent to Splunk SOAR.
  2. Copy the curl command to the ssh prompt
    1. a return code will be returned if it reached the endpoint
  3. Ssh to the Splunk SOAR appliance and tail the log below to verify that API messages are reaching the endpoint correctly.
    1. tail -f /opt/<installdir>/var/log/phantom/app_interface.log 
  4. NOTE: Once the CLI command successfully creates a container event message in the dashboard on Splunk SOAR you cannot run the script again without editing the ID value and incrementing the number.  Containers are unique with ID's set by the incoming data and will be automatically discarded as duplicate if the same ID is used.


Example Splunk SOAR Container and Artifact events

  1. Once configured and tested successfully the integration will create containers with artifacts attached.   
  2. Splunk SOAR container is a security event ingested from a third-party source. All containers are assigned labels, which enable Splunk to group related containers. Artifacts are objects that are associated with a container and serve as corroboration or evidence related to the container.
  3. Example container event
    1.  
  4. Artifacts represent critical data for Secops to use to make decisions on the approviate response.  The example below shows the Zero Trust payload data that is mapped into custom artifacts on the container.

© Superna Inc