Cisco Umbrella Add-On for Splunk

Overview

Details

DISCLAIMER: This add-on is no longer supported as there is now a first-party add-on developed by Cisco themselves: https://splunkbase.splunk.com/app/3324/

The purpose of this add-on is to provide CIM compliant field extractions for Cisco Umbrella OpenDNS logs AWS S3 bucket logs.

This add-on requires the Splunk Add-on for Amazon Web Services as the means of data on-boarding.

* Built for Splunk Enterprise 6.x.x or higher
* CIM Compliance (CIM 4.0.0 or higher)
* Ready for Enterprise Security
* Requires Splunk Add-on for Amazon Web Services (unless using Cisco Managed S3)
* https://splunkbase.splunk.com/app/1876/
* If using Cisco Managed S3, use their app here: https://splunkbase.splunk.com/app/5557/
* Supports Cisco Umbrella Log Management Version 1-5
* Supports Cisco Managed S3 buckets via awscli and a simple shell script (See Cisco Managed Buckets Instructions)

Cisco Umbrella Add-on for Splunk

Add-on Homepage:
Author: Hurricane Labs
Version: 1.0.7

Description

The purpose of this add-on is to provide CIM compliant field extractions for Cisco Umbrella OpenDNS logs AWS S3 bucket logs.

This add-on requires the Splunk Add-on for Amazon Web Services as the means of data on-boarding.

Built for Splunk Enterprise 6.x.x or higher
CIM Compliance (CIM 4.0.0 or higher)
Ready for Enterprise Security
Requires Splunk Add-on for Amazon Web Services (unless using Cisco Managed S3)
- https://splunkbase.splunk.com/app/1876/
- If using Cisco Managed S3, use their app here: https://splunkbase.splunk.com/app/5557/
Supports Cisco Umbrella Log Management Version 1-5

INSTALLATION AND CONFIGURATION

Search Head: Required
Heavy Forwarder: Optional
Indexer: Optional
Universal Forwarder: Not Supported
Light Forwarder: Not Supported

Ultimately this add-on needs to be installed on your Search Head and on the AWS Add-on collection point. It is recommended that you setup the AWS inputs on a Heavy Forwarder, and it is recommended that you setup the Cisco Umbrella Add-on on the Heavy Forwarder and Search Head. If you are using your Search Head as the AWS collection point, then this only needs to go on your search head. If your AWS collection point is on your Indexer, then this add-on needs to go on the Indexer and on your Search Head.

Setting up AWS Input

Reference Link: https://support.umbrella.com/hc/en-us/articles/230650987-Configuring-Splunk-for-use-with-Cisco-Umbrella-Log-Management-in-AWS-S3
1. Refer to the reference link to configure AWS and set up the account in Splunk, you can follow the rest of the steps in this guide when you reach the "Configuring Data Inputs for Splunk" step.
2. Navigate to the Splunk Add-on for AWS
3. Create a new input (Custom Data Type > Generic S3)
4. Select the appropriate AWS Account/Role/S3 Bucket
5. (Recommended) Do not set a S3 Key Prefix, and change the sourcetype to "opendns:s3".
5. (Optional) If you want more control over the data you bring in, you'll need to do separate inputs using these S3 Key Prefixes "/proxylogs/", "/dnslogs/", "/firewalllogs/", "/auditlogs/" and "/iplogs/". Each of these will use it's own sourcetype: "opendns:dnslogs", "opendns:proxylogs", "opendns:firewalllogs", "opendns:auditlogs", and "opendns:iplogs"

Heavy Forwarder & Search Head (RECOMMENDED)

Install the add-on on the Heavy Forwarder and Search Head. A Splunk Restart may be required, you may also attempt a debug refresh.
Configure the AWS Input to scrape your OpenDNS S3 bucket;
2a. One Input: If you scrape the entire bucket, you NEED to use sourcetype "opendns:s3"
2b. Multiple Inputs: If you want more control over the buckets being scraped, this add-on supports multiple inputs. There are three types of logs sent by Umbrella OpenDNS; "/proxylogs/", "/dnslogs/", "/firewalllogs/", "/auditlogs/" and "/iplogs/". Each input should use exactly one of those prefixes. The respective sourcetypes for those prefixes are as follows; "opendns:dnslogs", "opendns:proxy", "opendns:firewalllogs", "opendns:auditlogs" and "opendns:iplogs".
Verify data is coming in and you are seeing the proper field extractions by searching the data.
Example Search: index=awsindexyouchose sourcetype=opendns:* | dedup sourcetype

Search Head Only

Install the add-on on the Search Head. A Splunk Restart may be required, you may also attempt a debug refresh.
Configure the AWS Input to scrape your OpenDNS S3 bucket;
2a. One Input: If you scrape the entire bucket, you NEED to use sourcetype "opendns:s3"
2b. Multiple Inputs: If you want more control over the buckets being scraped, this add-on supports multiple inputs. There are three types of logs sent by Umbrella OpenDNS; "/proxylogs/", "/dnslogs/", "/firewalllogs/", "/auditlogs/" and "/iplogs/". Each input should use exactly one of those prefixes. The respective sourcetypes for those prefixes are as follows; "opendns:dnslogs", "opendns:proxy", "opendns:firewalllogs", "opendns:auditlogs" and "opendns:iplogs".
Verify data is coming in and you are seeing the proper field extractions by searching the data.
Example Search: index=awsindexyouchose sourcetype=opendns:* | dedup sourcetype

Indexer and Search Head (NOT RECOMMENDED)

Install the add-on on the Indexer and Search Head. A Splunk Restart may be required, you may also attempt a debug refresh.
Configure the AWS Input to scrape your OpenDNS S3 bucket;
2a. One Input: If you scrape the entire bucket, you NEED to use sourcetype "opendns:s3"
2b. Multiple Inputs: If you want more control over the buckets being scraped, this add-on supports multiple inputs. There are three types of logs sent by Umbrella OpenDNS; "/proxylogs/", "/dnslogs/", "/firewalllogs/", "/auditlogs/" and "/iplogs/". Each input should use exactly one of those prefixes. The respective sourcetypes for those prefixes are as follows; "opendns:dnslogs", "opendns:proxy", "opendns:firewalllogs", "opendns:auditlogs" and "opendns:iplogs".
Verify data is coming in and you are seeing the proper field extractions by searching the data.
Example Search: index=awsindexyouchose sourcetype=opendns:* | dedup sourcetype

Cisco Managed Buckets Instructions

Use the official Cisco app: https://splunkbase.splunk.com/app/5557/

New features

1.0.3: Added support for Cisco Managed Bucket
1.0.5: Adds support for logging format version 5 + Firewall Logs
1.0.6: Adds support for Audit Logs
1.0.7: Added additional CIM fields for OpenDNS: query_type, message_type

Fixed issues

1.0.1: Added timezone setting as logs are requested in UTC by default.
1.0.2: Fixed "category" field as it was being split into "categories" field which broke lookup table functionality. Removed trailing dot at the end of "query" field.
1.0.3: Added vendor_product field, lowered action field for CIM compliance, altered eventtype to account for managed buckets.
1.0.4: Fixes an issue in the README under delete-old-umbrella-logs.sh

Known issues

No support for log format version 6 that adds new Proxy Log fields for SWG/DLP modules. If you have these logs please send us (see Dev Support email) some samples and we will add support to this TA.

Third-party software attributions

opendns_dnslogs_categories.csv from https://api.opendns.com/v3/categories

DEV SUPPORT

Contact: splunk-app@hurricanelabs.com

Release Notes

Version 1.0.7

Dec. 10, 2021

New features

1.0.3: Added support for Cisco Managed Bucket
1.0.5: Adds support for logging format version 5 + Firewall Logs
1.0.6: Adds support for Audit Logs
1.0.7: Added additional CIM fields for OpenDNS: query_type, message_type

Version 1.0.6

Oct. 15, 2021

New features

1.0.3: Added support for Cisco Managed Bucket
1.0.5: Adds support for logging format version 5 + Firewall Logs
1.0.6: Adds support for Audit Logs

Fixed issues

1.0.1: Added timezone setting as logs are requested in UTC by default.
1.0.2: Fixed "category" field as it was being split into "categories" field which broke lookup table functionality. Removed trailing dot at the end of "query" field.
1.0.3: Added vendor_product field, lowered action field for CIM compliance, altered eventtype to account for managed buckets.
1.0.4: Fixes an issue in the README under delete-old-umbrella-logs.sh

Known issues

No support for log format version 6 that adds new Proxy Log fields for SWG/DLP modules. If you have examples of these logs please send us (see Dev Support email) some samples and we will add support to this TA.
Audit Logs may appear in the S3 bucket in a non-standard format, this causes some events to misbehave.

Version 1.0.5

May 18, 2021

1.0.5: Adds support for logging format version 5 + Firewall Logs

Version 1.0.4

July 4, 2020

Updates readme

Version 1.0.3

Nov. 15, 2019

New features

1.0.3: Added support for Cisco Managed Bucket

Fixed issues

1.0.1: Added timezone setting as logs are requested in UTC by default.
1.0.2: Fixed "category" field as it was being split into "categories" field which broke lookup table functionality. Removed trailing dot at the end of "query" field.
1.0.3: Added vendor_product field, lowered action field for CIM compliance, altered eventtype to account for managed buckets.

Version 1.0.2

Jan. 22, 2019

New features

1.0.2: Added support for Version 3 and 4 which adds additional fields granular_identity_type, identity_type, and blocked_category.

Fixed issues

1.0.2: Fixed "category" field as it was being split into "categories" field which broke lookup table functionality. Removed trailing dot at the end of "query" field.

Version 1.0.1

July 19, 2018

Version 1.0.1 released.
+ Added timezone setting as logs are requested in UTC by default.
+ Added better instructions for setting up the AWS inputs, alongside a reference link to setup instructions on Umbrella's website.

The purpose of this add-on is to provide CIM compliant field extractions for Cisco Umbrella OpenDNS logs AWS S3 bucket logs.

This add-on requires the Splunk Add-on for Amazon Web Services as the means of data on-boarding.

+Built for Splunk Enterprise 6.x.x or higher
+CIM Compliance (CIM 4.0.0 or higher)
+Ready for Enterprise Security
+Requires Splunk Add-on for Amazon Web Services
++https://splunkbase.splunk.com/app/1876/
+Supports Cisco Umbrella Log Management Version 1.1

Version 1.0.0

March 29, 2018

The purpose of this add-on is to provide CIM compliant field extractions for Cisco Umbrella OpenDNS logs AWS S3 bucket logs.

This add-on requires the Splunk Add-on for Amazon Web Services as the means of data on-boarding.

6,859

Downloads

Share Subscribe

Version

Built by

Hurricane Labs

Support

Not Supported

Questions on Splunk Answers Flag as inappropriate

Technologies: Cisco