Splunk ES Asset & Identity

Splunk
Mumbai User
Group
 Join splunk_mumbai_usergroup on Slack
 Use _mumbai_usergroup for Q&A during
session.
 Please keep your line muted .
 Questions/doubts to be entered in conversation.
 Slides, Recording and Feedback form will be
posted on the Event Page after the session.
https://usergroups.splunk.com/mumbai-splunk-user-group/
1

• 2+ years of Splunk experience
• Project lead at Avotrix
• Enterprise Security, ITSI, APM, Phantom & UBA
• Creating Blogs.
• Splunk trainer
About me !
2

Introduction to Mumbai User Group
3

Splunk ES –Asset &
Identity concept
4

Agenda
1. Introduction
2. Splunk ES basics
3. How to manage Incidents
4. Asset and Identities concept
5. Data sources for integrating asset and identity data
6. SA-ldapsearch add-on and ldap query
7. Asset and identity lookup creation Practical
8. Usecase
9. Conclusion
10.Q&A
5

Splunk ES
Basics?
6
 Incident Management
 Adaptive Response
 Asset and Identity
 Threat Intel
 Risk

7
Splunk ES Working to alert and manage incidents
CIM
compatible
data source
Investigation
review dashboard
Create Notable event-by
selecting alert action as
notable event
Correlation
searches
Update Kvstore
collection for
incidents
Assign incidents
to the team
Windows
Firewall
Active
directory

8
Asset and Identity concept?
Asset and identity concept helps you to find what, why, and where about security use cases and helps
you to drilldown more to find root cause.
Alert with
hostname,
computer name, ip
, port
Alert with
hostname,
computer name,
ip , port ,
workstation
owner details,
workstation
access details,
user role.
Get data

9
How to integrate your asset and identity in splunk
ES?
We are using LDAP or Active Directory: Configure the Splunk Supporting Add-on for Active Directory (SA-ldapsearch)
to query your LDAP/Active Directory environment.
Manually
(monitoring file
from servers)
Use LDAP to
register data in
Asset and
Identity Manager
Use cloud service
provider data to
register data in
Asset and Identity
Manager
You have below choices for registering asset and identity data in ES

10
Asset
and
identities
data
collection
method.
Technology Asset or Identity data Collection methods
Active Directory Both SA-ldapsearch and a custom search.
Both SecKit Windows Add On for ES Asset and
Identities *
LDAP Both SA-ldapsearch and a custom search.
CMDB Asset DB Connect for integrating with 3rd Party
structured data sources, and a custom search.
ServiceNow Both Splunk Add-on for ServiceNow
Bit9 Asset Splunk Add-on for Bit9 and a custom search.
Cisco ISE Both Splunk Add-on for Cisco ISE and a custom
search.
Microsoft SCOM Asset Splunk Add-on for Microsoft SCOM and a
custom search.
Okta Identity Splunk Add-on for Okta and a custom search. *
Sophos Asset Splunk Add-on for Sophos and a custom
Symantec Endpoint Protection Asset Splunk Add-on for Symantec Endpoint
Protection and a custom search.
Amazon Web Services (AWS) Asset SecKit AWS Add On for ES Asset and
Configuration Management
(CMDB)
Asset SecKit SA Common tools for populating assets
and identities in Enterprise Security and PCI
*

Link to LDAP query from SA-
ldapsearch documentation:
https://docs.splunk.com/Docum
entation/SA-
LdapSearch/3.0.3/User/Theldap
searchcommand
11
SA- ldapsearch add-on configuration

LDAP query to retrieve identity data
|ldapsearch domain=<corp.domain.com>
search="(&(objectclass=user)(!(objectClass=computer)))"
attrs="sAMAccountName,personalTitle,displayName,givenName,sn,mail,telephoneNumber,mobile,manager,department
,whenCreated,userAccountControl"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval suffix=""
|eval priority="medium"
|eval category="normal"
|eval watchlist="false"
|eval endDate=""
|table
sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,depa
rtment,category,watchlist,whenCreated,endDate
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail
as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as
startDate
Ref: https://conf.splunk.com/files/2019/slides/FN2268.pdf
12

LDAP query to retrieve Asset data
|ldapsearch domain=<corp.domain.com>
search="(&(objectClass=computer))" attrs="distinguishedName, dNSHostName, managedBy, sAMAccountName“
| rex max_match=5 field=distinguishedName "OU=(?<dn_parsed>[^,]+)"
| eval nt_host=replace(sAMAccountName, "$", ""), dns='dNSHostName', owner='managedBy', bunit_split=split(dn, ","),
category=lower(replace(mvjoin(dn_parsed, "|"), " ", "_")), priority=case(match(category,
"domain_controller|exchange|citrix"), "critical", match(category, "server|disabled"), "high", match(category,
"workstation|desktop|mobile|laptop|computer"), "medium", category IN ("staging", "test"), "low", 1==1, "unknown"),
is_expected=if(priority IN ("critical", "high"), "true", "false") , country ="India", city="Mumbai",
owner=if(isnull(owner),"Admin",owner)
| search nt_host!="provAgentgMSA"
| rex field=bunit_split "(OU)=(?<bunit>.+)" | rex field=owner "(CN)=(?<owner>w+sw+),OU="
| table ip, mac, nt_host, dns, owner, priority, lat, long, city, country, bunit, category, pci_domain, is_expected,
should_timesync, should_update, requires_av
Ref: https://conf.splunk.com/files/2019/slides/FN2268.pdf
13

Asset and identity lookup creation
14
Create a custom lookup table file mydata.csv
Create a lookup table definition mydata
Save Ldapsearch and schedule as report to automatically fill
custom lookup
Define custom lookup in Splunk ES app >>configure
ES>>data enrichment>>identity management
Use ldapsearch to generate the custom lookup table
data

How my lookup name
Changed ?
15
Let’s get into details………..

Asset and identity lookup management using
entity merge command
One will spot this under configure and data enrichment:
 identity_lookup_expanded
| àdd_entity_source("administrative_identity_lookup","administrative_identities")` | àdd_entity_source("AvotrixIdentity","AvotrixIdentity")` | àdd_entity_source("simple_identity_lookup","static_identities")` |
eval identity=split(identity, "|"),identity=if(_source=="administrative_identities", mvappend(identity,`get_mv_item0("email")`), identity),identity=if(_source=="AvotrixIdentity",
mvappend(identity,`get_mv_item0("email")`,replace(`get_mv_item0("email")`,"@.*","")), identity),identity=if(_source=="static_identities", mvappend(identity,`get_mv_item0("email")`),
identity),identity=mvjoin(mvdedup(identity), "|") | table
"_source","cim_entity_zone","bunit","category","email","endDate","first","identity","last","managedBy","nick","phone","prefix","priority","startDate","suffix","watchlist","work_city","work_country","work_lat","work_l
ong" | eval ìden_mktime_meval(startDate)`,ìden_mktime_meval(endDate)`,identity=mvsort(identity) | sort 0 +identity | inputlookup append=T "identity_lookup_expanded" | entitymerge "identity“
 asset_lookup_by_str
| àdd_entity_source("AvotrixAsset","AvotrixAsset")` | table
"_source","cim_entity_zone","bunit","category","city","country","dns","ip","is_expected","lat","long","mac","nt_host","owner","pci_domain","priority","requires_av","should_timesync","should_update" |
`make_ip_str` | inputlookup append=T "asset_lookup_by_str" | entitymerge "asset"
 asset_lookup_by_cidr
| àdd_entity_source("AvotrixAsset","AvotrixAsset")` | table
"_source","cim_entity_zone","bunit","category","city","country","dns","ip","is_expected","lat","long","mac","nt_host","owner","pci_domain","priority","requires_av","should_timesync","should_update" |
`make_ip_cidr` | inputlookup append=T "asset_lookup_by_cidr" | entitymerge "asset"
17

Using Asset &
Identity with security
use case
18
Expired user login activity to network:
An ex-employee tried to access organizational resources , whether it may get
failed or passed .It is a threat to the security of your company data . Identity
lookup helps you to get additional details here like their account expiry date
pulling by LDAP server

Hereweareshowingand dummyuser “Krishna”.Whouseraccountexpirydatewas20th May2021.Nowthrough “Expiryuseraccount
activitydetected”alert,wegotanincidentthatsomeoneuseduser“Krishna”andtriedtologinon15th sept2021.Thisisasecuritythreat.
Throughauthenticationlogweweregettinginfolike,useranditslastest_access_time .Nowasyoucansee,weusedESidentitylookupget
moredetails
Expired user login alert use-case

Custom lookup VS Asset and identity lookup
21
Lookup A Lookup C
Lookup B
Writing query for joining 3 lookups to
enrich a search
No automatic data model
Lookup A Lookup C
Lookup B
Query will be much optimized as
using single lookup
Asset and identity lookup data gets
into data model-Asset And
Identities
Datamodels are easy to work
“identity_lookup_expanded” using
single lookup

Splunk ES Asset & Identity

Recommended

More Related Content

What's hot (20)

Similar to Splunk ES Asset & Identity (20)

Recently uploaded (20)

Splunk ES Asset & Identity