Splunk SOAR On Premise Alarm Integration with Zero Trusts Alarms

• Overview of Splunk On premise SOAR Solution
• Support Statement
• Limitations
• Solution Overview
• Features
• What is Splunk SOAR?
• Solution Configuration in Splunk Enterprise and Defender Zero Trust
• Prerequisites
• Configuration in Splunk SOAR
• Configure Data Security Edition Integration
• Configure Data Security Edition Zero Trust Webhooks
• How to test the Integration with Splunk SOAR
• Example Splunk SOAR Container and Artifact events

Overview of Splunk On premise SOAR Solution

1. Splunk Phantom, renamed to Splunk SOAR, is a security orchestration, automation, and response (SOAR) solution. Security automation involves machine-based execution of security actions to detect, investigate and remediate threats programmatically.  Customers can now leverage the full automation capabilities of a SOAR with Superna Zero Trust API's.

Support Statement

1. NOTE:  This documentation is provided "as is" without support for 3rd party software.  The level of support for this integration guide is best effort without any SLA on response time.  No 3rd party product support can be provided by Superna directly.  3rd party components require support contracts

Limitations

Solution Overview

Superna Security Edition Zero Trust API is the cornerstone technology used to integrate with SIEM, SOAR and XDR platforms.   Automation begins with data that summarizes the threat and places that information into a security tools to be acted on by Secops and run playbooks to protect corporate IT assets from vulnerabilities and insider or external attackers.   The Splunk Soar platform can act on container events and artifacts that provide details on the incident with all relevant data provided to act on with playbooks and automation cross domain.

Features

1. An Event will be created with artifacts on the first event with fields mapped,   
2. Updates to that event in Data Security Edition will append notes to notes field of event based on matching the alarm ID in DSE to the event created in Splunk SOAR.

What is Splunk SOAR?

Splunk SOAR is a data-centric, modern security information and event management (SIEM) solution that delivers data-driven insights for full-breadth visibility into your security posture so you can protect your business and mitigate risk at scale.

Solution Configuration in Splunk Enterprise and Defender Zero Trust

Prerequisites

1. Installed Security Edition
2. Installed Splunk SOAR On Premise 
3. Eyeglass OS appliance version 15.5
   1. cat /etc/os-release    

Configuration in Splunk SOAR

1. Information Needed to complete the Configuration
   1. automation user token
   2. endpoint url of the REST data source application to receive the webhook data
   3. Firewall ports to allow the Eyeglass VM to reach the Splunk Soar endpoint over https port 443
2. Login to Splunk SOAR application as administrator 
3. Get the Automation user authentication token
   1. Under the administration menu locate the User management 
   2.  
   3. Edit the automation user
      1. Click the show token button and record the token to be used later in the configuration.
      2. The Allowed IP's field needs to list the subnet or ip address of the Eyeglass VM to allow webhook data to authenticate using the API token.   Type CIDR or any for allowing any ip to issue api calls.
      3.  
      4. click show token and record 
      5.   
   4. Done  

Configure Data Security Edition Integration 

High Level steps

1. Create python location to run the application on the Eyeglass vm
2. Create python main application script
3. Create linux systemd service and set to auto start
4. Create Zero Trust configuration in Defender
5. Update the main script to customize with splunksoar python code
6. Test the script is running as a service
7. Create a test event in Defender to validate the alerts appear as indexed parsed events in splunksoar

Configuration Step by Step

1. Login to the eyeglass VM as admin user
2. Follow the steps below

Configure the Service start and python integration files

Configure the python packages and customize the splunksoar integration python code

1. Customize the application code by downloading the python code from this link to download (right click download as)
   3. Open the python template file in a text editor. NOTE: make sure to only replace the yellow values (endpoint url for http ingestion of your splunksoar instance, the api token)
   4. Locate this section in the file, replace yellow highlights.    Change the port if different from below.  Comment out ECS endpoint and uncomment Splunk HEC if using HEC format and set the hec_format = True to enable HEC format.
      3. # === splunksoar Configuration ===

         PHANTOM_SERVER = "https://y.y.y.y:8443"

         PH_AUTH_TOKEN = "xxxxxxxx"

         VERIFY_SSL = False

         PHANTOM_LABEL = "events"
   5. Paste the updated script into the production file
      3. nano /opt/superna/cgi-bin/splunksoar.py
      4. Open the file locally in Windows OS notepad and use control-A or select all the text.
      5. Paste the clipboard into the ssh terminal session with the open nano editor file
      6. save the file
         3. press control+x
         4. Answer yes to save and exit the nano editor 
2. Start the service and verify it is running
   1. systemctl start splunksoar
   2. systemctl status -l splunksoar
   3. Verify the service is started successfully and returns "active and running".
3. If the service does not start do not proceed and double check the steps above are completed. 

Configure Data Security Edition Zero Trust Webhooks

1. The next step creates an Zero Trust Webhook URL.    
   
   1. Configure Zero Trust endpoint in Ransomware Defender Zero Trust tab.
      1. Recommended Configuration: Only Critical and Major events and only the webhooks that set lockout or delayed lockout.   Customers can customize based on specific requirements. The goal is to send findings versus a list of alarms that do not pinpoint a security incident.
      2.   
      3. The endpoint url above will use localhost and will send Webhooks to the application service listening on port 5000. URL to use in the configuration
         1. Add the name Splunk SOAR
         2. paste the REST Data Handler endpoint URL into the URL field 
         3. Add the Content-Type header with value of application/json as shown above to complete the webhook configuration.
         4. Add the custom header ph-auth-token and the automation token captured in the steps above for the value field.
         5. Click save
         6. Click save on the main Webhook configuration page
2. Test the configuration is working following the next section

How to test the Integration with Splunk SOAR

1. To test the integration follow these steps
1. download this curl command template and open with a text editor
   1. locate the very end of the curl command and edit the url and replace the section below with the endpoint recorded above.
      1. "https://172.31.1.246/rest/handler/restdatasource_95e3bcff-bfca-454d-b59e-768da6280c38/supernazt" 
      2. Save the file
2. Paste the entire cli command to the ssh prompt to send sample data to the running Zero Trust application.  This will send test data directly to the application to be processed and sent to Splunk SOAR.
2. Copy the curl command to the ssh prompt
   1. a return code will be returned if it reached the endpoint
3. Ssh to the Splunk SOAR appliance and tail the log below to verify that API messages are reaching the endpoint correctly.
   1. tail -f /opt/<installdir>/var/log/phantom/app_interface.log 
4. NOTE: Once the CLI command successfully creates a container event message in the dashboard on Splunk SOAR you cannot run the script again without editing the ID value and incrementing the number.  Containers are unique with ID's set by the incoming data and will be automatically discarded as duplicate if the same ID is used.

Example Splunk SOAR Container and Artifact events

1. Once configured and tested successfully the integration will create containers with artifacts attached.   
2. Splunk SOAR container is a security event ingested from a third-party source. All containers are assigned labels, which enable Splunk to group related containers. Artifacts are objects that are associated with a container and serve as corroboration or evidence related to the container.
3. Example container event
   1. 
   2. 
   3. 
      
   4. 
   5. 
   6.