INSTALLATION

Prerequisites and Requirements

* Splunk Enterprise 6.6.0 or above
* Set environment variable SPLUNK_HOME
* Splunk Enterprise Security App 5.0 or above

Installing Dependencies

* If destination server is UNIX or Check Point Gateway, sshpass utility should be installed on Splunk server if Splunk is installed on Unix OS and pscp.exe must be installed on Splunk server if Splunk is installed on Windows OS.
* If destination server is Windows, File and Printer Sharing must be enabled and also the folder where file needs to be uploaded must be shared. (Note: For folder sharing, it must be enabled through advanced sharing and a share name must be obtained, i.e. name of the folder to be shared and not the complete path)

Installation Steps

* Check Point Response Add-on for Splunk should be installed and configured on Search Head only where Splunk Enterprise Security Suite is present. In standalone environment, Search Head and Indexer could be the same machine.
* In case of Search Head Cluster follow the steps mentioned in the below link to install the app:
http://docs.splunk.com/Documentation/Splunk/7.1.1/DistSearch/PropagateSHCconfigurationchanges

SETUP

* Login to Splunk WEB UI.
* Go to the configuration page of the app.
* Click the Configuration menu and click Add in the Server tab.
* Fill the appropriate details in the Add Server dialog:
    - Name: Unique name for the server.
    - Server Group Name: Group name (case sensitive) for the server. It can be same for multiple servers. Users can select this group name while configuring alert action to upload to all the servers of the group.
    - Server OS: Operating System of the server.
    - Server IP/ Hostname: IP or Hostname of the server
    - Port Number: Port to use for file transfer. Defaults to 22 if nothing is specified (Not needed if server OS is Windows).
    - Domain: Domain to which the server belongs (Only if the server OS is Windows)
    - Authentication Mechanism: Authentication mechanism to be used for connecting to the server.
    - Username: Username of the server.
    - Password/Passphrase: Password for the username specified or Passphrase for the key.
    - Key File Path (Local): Path to the private key file. The specified path should be of the local machine where the app is configured.
    - Upload Path: Path on the server where the user wants to upload the IOC file.
* Click Add
* Note: For validation of the parameters provided, the App would upload a sample text file named “splunk_test_file_transfer.txt” on the destination server at specified location.

ADAPTIVE RESPONSE ACTION

This app includes “Check Point Upload IOC” AR action. This action uploads the specified IOCs and their metadata to the configured destination machine in csv format. 
User needs to fill up the action HTML form to provide the details regarding the IOCs. Refer the table below to fill in the action HTML form:
- Type: Type of the indicator.
        Supported Values: Domain, Mail from, Mail-cc, Mail-reply-to, Mail-to, Mail-subject, URL, MD5, IP(ipv4 only), IP Range
- Input Type: Type of the input.
        Supported Values:
            1. Field Name: Select this option if you want to obtain value of “Value”, “Severity”, “Confidence” and “Comment” from certain fields in events. Thereafter you need to provide the field name in those inputs from which the values can be obtained.
            2. Value: Select this option if you want to provide the value of “Value”, “Severity”, “Confidence” and “Comment” directly.
- Value: Valid value, based on the selected “Type” of the indicator. 
- Severity: Severity of the indicator.
            Supported Values: low, medium, high, critical
            Default: high
- Confidence: Confidence of the indicator.
              Supported Values: low, medium, high
              Default: high
- Comment: Comment for the indicator.
           Default: “Splunk reported IOC”
- Product: Check Point software blade that processes the indicator.
           Supported Values: 
           1. AV: Check Point Anti-Virus software blade
           2. AB: Check Point Anti-Bot software blade
           Note: MD5 can only be processed by AV software blade.
- Expiration Time (In minutes): Expiration time of the indicator in minutes.
                                Default: 86400 minutes
- Server: Server group where you want to upload the file. 
          These are the groups you configured in the configuration page. 
          File will be uploaded on all the servers of the selected group.

This action maintains the list of IOCs and its metadata in the KV Store. This metadata also includes the expiration time. To delete the IOCs that have expired, this app contains “checkpoint_kvstore_update_search” saved search which is set to run at 12:00 PM and 12:00 AM by default. User can modify this schedule according to their requirements.
This action can be executed automatically by associating it to the correlation searches or manually where the user can first just push events to notable index and thereafter can invoke it from “Incident Review” dashboard of Splunk Enterprise Security App. Follow the steps below to use this AR action:

Defining Searches

Consider you are receiving threat feeds from various platforms in Splunk under “threat” index. Now having known these threats we want to upload them to the Check Point Gateway, so that the Check Point Gateway can take appropriate actions on them. Below is the search query for the same:

index=”threat” sourcetype=”ip:threats” | table ioc_name, ioc_value, confidence, ioc_severity, ioc_comment

The search should output only one type of indicators and hence user will be required to create one search for each supported indicator type. The fields ioc_name, ioc_value, confidence, ioc_severity and ioc_comment are mandatory in the output events if the user wants to invoke the action automatically. While associating the action to the correlation search user needs to provide these fields as input.

You may invoke Action in two ways:
    1. Saved Mode of Invocation
    2. Adhoc Mode of Invocation

TROUBLESHOOTING

* Authentication Failure: Check the network connectivity and verify that all the mentioned dependencies are installed based on the deployment. Make sure that the destination Server is reachable by executing “ping <server>” command on terminal or command prompt. Make sure that the details provided for the authentication mechanism are correct.
* Adaptive Response Action Failure: There can be multiple reasons as mentioned below for the failure:
    - Provided details in the action HTML form are incorrect. Ex: The field name provided in the action HTML form might not be present in the event or invalid value of indicator, severity, confidence or product. Hence verify the details.
    - Make sure that the selected server group in the action HTML form is configured in the configuration page of the app and you are able to authenticate to all the servers of that group.
    - User can view “checkpoint_upload_ioc_modalert.log” file located at $SPLUNK_HOME/var/log/splunk or can execute “index=cim_modactions sourcetype=modular_alerts:checkpoint_upload_ioc” query to get more details of the failure.
* Missing Records in CSV File: The app uses KV Store to maintain the indicators and their metadata. When the action is executed all the records are fetched from KV Store and CSV is created using that data. The default maximum size of the result that can be fetched in single query is 50 MB. Hence if the data is more, create “limits.conf” file in $SPLUNK_HOME/etc/system/local and configure it accordingly.
    For more information you can refer “[kvstore]” section mentioned in https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Limitsconf
* Alert Action Terminates after Some Time: If the alert action is aborted, user can increase the timeout of the action. For that user needs to create $SPLUNK_HOME/etc/apps/TA-checkpoint_response/local/alert_actions.conf and replace the param.timeout field with higher value.
* Slow Performance Due to Huge Amount of Data: If the number of indicators are huge, user can increase the amount of indicators processed in a single API call. The default limit is set to 1000 records but user can modify this limit. To do so, create “limits.conf” file in $SPLUNK_HOME/etc/system/local and paste the below contents in it and save:
    [kvstore]
    max_queries_per_batch = 2000
    After making this modification in limits.conf, navigate to $SPLUNK_HOME/etc/apps/TA-checkpoint_response/default/alert_actions.conf and under “[checkpoint_upload_ioc]” section and increase the value of “param.batch_size” attribute.
    Note: Provide a valid positive integer. Don’t provide too huge value as it may result in API call failure.

KNOWN LIMITATIONS

* When passphrase is added during key generation, password based authentication may not work.
* If key is installed and even if incorrect password is entered, the authentication will be successful.
* In case of field based inputs, the AR action might not add value of comment field in the csv if the value (field name) of the Comment parameter is "comment". Hence it is recommended to use any other field name.

SUPPORT

* Support Offered: Yes
* Supported by Check Point team through Splunk Community on best effort

Copyright (C) by Check Point Software Technologies Ltd. All Rights Reserved.

Check Point Adaptive Response Add-on

0