RiskSense App For Splunk

OVERVIEW

The RiskSense App For Splunk delivers a user experience designed to make Splunk immediately useful and relevant for typical tasks and roles. The following functionality is provided:
* Dashboards to visualize the RiskSense data.
* The App uses data collected by the RiskSense Add-on to present the above dashboards.

Author - RiskSense
Version - 1.0.0
Build - 1
Prerequisites - RiskSense Add-on for Splunk
Compatible with:
Splunk Enterprise version: 8.0.x, 7.3.x, 7.2.x, and 7.1.x
OS: Platform independent

END USER LICENSE AGREEMENT

https://risksense.com/customer-agreements/

OPEN SOURCE COMPONENTS AND LICENSES

RECOMMENDED SYSTEM CONFIGURATION

Splunk forwarder system should have 12 GB of RAM and a six-core CPU to run this App smoothly.

TOPOLOGY AND SETTING UP SPLUNK ENVIRONMENT

This App can be set up in two ways:

1) Standalone Mode: Install the app on a single machine. This single machine would serve as a Search Head + Indexer + Heavy forwarder for this setup.
2) Distributed Environment: Install app on search head.

App resides on search head machine to visualize the data coming from forwarders.

INSTALLATION

Follow the below-listed steps to install an App from the bundle:

Download the App package.
From the UI navigate to Apps->Manage Apps.
In the top right corner select Install app from file.
Select Choose File and select the App package.
Select Upload and follow the prompts.

UPGRADE

Follow the below steps when upgrading from RiskSense App for Splunk

From the UI navigate to Apps->Manage Apps.
In the top right corner select Install app from file.
Select Choose File and select the App package.
Check the upgrade option.
Select Upload and follow the prompts.
Restart Splunk.

SAVEDSEARCHES AND ALERTS

RiskSense Hosts Critical Severity Alert - This alert triggers when the number of critical severity vulnerabilities increases for a particular host.
RiskSense Hosts High Severity Alert - This alert triggers when the number of high severity vulnerabilities increases for a particular host.
RiskSense Hosts Medium Severity Alert - This alert triggers when the number of medium severity vulnerabilities increases for a particular host.
RiskSense Hosts RS<sup>3</sup> Alert - This alert triggers when the RS<sup>3</sup> increases or decreases for a particular host.
RiskSense Applications Critical Severity Alert - This alert triggers when the number of critical severity vulnerabilities increases for a particular application.
RiskSense Applications High Severity Alert - This alert triggers when the number of high severity vulnerabilities increases for a particular application.
RiskSense Applications Medium Severity Alert - This alert triggers when the number of medium severity vulnerabilities increases for a particular application.

CONFIGURING EMAIL ALERT ACTION

Follow below steps to configure email alert action for any of the savedsearches:
Navigate to Settings -> Searches, Reports, and Alerts.
Select App to be RiskSense App for Splunk.
In the Actions tab, click on Edit -> Edit Alert.
Go to Trigger Actions -> Add Actions -> Send Email.
Add details like To, Subject, Message and select appropriate attachments.
Click Save.

LOOKUPS

risksense_hosts_severity_details - This is a kvstore lookup which will consist of the severity details of all hosts.
risksense_apps_severity_details - This is a kvstore lookup which will consist of the severity details of all applications.

CUSTOM COMMAND

rsgetfindings - This command fetches Hosts and Applications Findings information from RiskSense API.
syntax - | rsgetfindings client_id="123" asset_type="hostFindings" severity="critical" asset_id="123456" host_name="hostname" application_name="application name" operator="EXACT | WILDCARD" filters="field1=value1:OPEATOR1"
Asset type can have hostFindings | applicationFindings value. Severity can have CRITICAL | HIGH | MEDIUM | LOW | INFO | TOTAL values. Operator can have EXACT | WILDCARD value.
Notes
The custom command will only run if the user has admin roles assigned or the user has admin_all_objects capability added.
For the custom command to fetch the account credentials, the user has to configure RiskSense Add-on for Splunk.
The custom command fetches the live records by making an API call when the search is run. If the Splunk instance is behind a proxy, the user needs to configure proxy settings in RiskSense Add-on for Splunk.

UNINSTALL APP

To uninstall app, user can follow below steps: SSH to the Splunk instance Go to folder apps ($SPLUNK_HOME/etc/apps) Remove the risksense_app_for_splunk folder from apps directory Restart Splunk

SUPPORT

support@risksense.com
Copyright (C) 2020 RiskSense, Inc. All rights reserved.