Stamus Networks App for Splunk
Overview
Details
Stamus Networks develops advanced network threat detection and response solutions, including the Scirius Security Platform and the open source SELKS.
Scirius Security Platform is used by security practitioners worldwide to expose real threats to their critical assets, empower their team’s rapid response, and mitigate their organization's risk. Its analytics engine that sits atop a unique combination of network traffic analysis (NTA), network intrusion detection (IDS) and organizational context allows users to quickly detect, investigate, and respond to threats and security policy violations.
The Stamus Networks App for Splunk allows Splunk Enterprise users to extract information and insights from both the Scirius Security Platform and open source Suricata sensors. It provides dashboards and reports but also a set of commands to interact with Scirius Security Platform via its REST API.
To learn more about Scirius Security Platform visit this page: https://www.stamus-networks.com/scirius-platform
The Stamus Networks App for Splunk enables threat hunters, incident responders and other security practitioners who use Splunk to tap into the power of Scirius Security Platform (SSP) or Suricata to more effectively do their job.
The Stamus Networks App for Splunk allows Splunk Enterprise users to extract information and insights from both the Scirius Security Platform and open source Suricata sensors. It provides dashboards and reports but also a set of commands to interact with Scirius Security Platform via its REST API.
Sources of the App are available on Github.
Initial Setup
Some visualizations depend on Timeline App that will have to be installed if not present on your Splunk® instance.
Scirius Security Platform users need to setup the connectivity with their SSP. To do so, you need to create a file local/ssp.conf under the application directory (/opt/splunk/etc/apps/stamus_for_splunk usually) and setup the following:
[config]
api_key = SSP_TOKEN
base_url = https://SSP_ADDRESS
check_tls = noThe SSP_TOKEN can be generated from Scirius Security Platform by going to Account Settings via the user icon on the top right and selecting Edit token. Only read access is necessary so a user with low privilege can be used.
Included dashboards and reports
Dashboards for Scirius Security Platform
- Stamus Networks Dashboard
- Stamus Networks IDS Dashboard
- Stamus Networks IP Investigation Dashboard
- Stamus Networks NTA Dashboard
- Stamus Networks Scririus Threat Radar Dashboard
Dashboards for Suricata Sensors
- Suricata Admin Dashboard
- Suricata Events Dashboard
- Suricata for Zeek Users Dashboard
- Suricata for IDS Dashboard
- Suricata for IP Investigation Dashboard
Reports
- Assets under Attack
- Domain Controllers List
- HTTP Servers
- HTTP Servers not running on port 80
- New Services on Known Hosts by Stamus Networks
- Recent services by Stamus Networks
- TLS Servers
- TLS servers not running on port 443
- Threats by Network
Using data from Host Identification module of SSP
Concept
Scirius Security Platform features a Host Identification module that builds identity cards of IP addresses seen
in the network without storing all raw events. This provides a concise view of the major attributes that can be linked to an IP address.
An host identification entry includes:
- List of hostnames associated with the IP
- List of usernames that connected to this IP
- List of network services
- List of HTTP user agents
- List of TLS agents (using JA3 technology)
- List of SSH agents
All this information is associated with a first-seen and last-seen timestamp, so it is possible to know
precisely when a username or a HTTP user agent was first seen on a given IP address.
Host ID search
To get software version of all HTTP server in a network (here internet):
| snhostsearch filter="services.values.app_proto=http net_info.agg=internet"| spath "services{}.values{}.http.server" | top "services{}.values{}.http.server"To get all hosts that are not running a version curl:
| snhostsearch filter="http_user_agent.agent!=curl*" | spath http_user_agent{}.agent output=agent | spath ip | top ip, agentHost ID filter
The snhostfilter commands allow you to select only events where src_ip or dest_ip is in the host ID set defined by the filter.
The following search returns all alerts for hosts running a service on port 443.
event_type="alert" | snhostfilter filter="services.port=443"Host ID lookup
The snhostlookup lookup resolves ip to hostname (and reverse) using the hostname information collected by SSP.
The following search returns all alert events and resolve destination ip to hostname.
event_type="alert"| lookup snhostlookup ip as dest_ip| stats count by hostnameUsing data from Stamus Threat events
Concept
The Scirius Threat Radar inside SSP generates events with type stamus that are high fidelity events generated from signatures or custom algorithms. These events are also mapped to the cyber kill chain to identify the phase of the attack.
Thread ID lookup
Get threat by network and use snthreatfilter to do threat_id resolution:
event_type="stamus" | eval Network = if('stamus.asset_net_info' == "", "Unknown", 'stamus.asset_net_info') | snthreatfilter | stats dc(stamus.asset) as Assets by Network, threat_nameYou can also lookup the Threat Family information via the snthreatfamilylookup:
event_type="stamus" | lookup snthreatfamilylookup family_id as stamus.family_id | top family_nameRelease Notes
Version 0.9.7
- Add drill down to dashboards
- Minor display fixes in dashboards
Version 0.9.6
- Add compatibility with Splunk 7.x
Version 0.9.5
- Better navigation
- Update colors
- Fix admin dashboard for multiple probes
Version 0.9.4
- CIM 4.x compatibility
- keys option added to snhostfilter for easy cross source filtering
- rename all commands with a sn prefix for better completion
- performance optimizations of dashboards
Version 0.9.2
- Improve IDS dashboards
- Fix timestamp pickers in Suricata admin Dashboard
Version 0.9.1
Fix errors and warnings found by the application checker.
Version 0.9.0
Initial release.
Features:
- dashboards for Suricata and Scirius Security Platform from Stamus Networks
- hostidsearch: search host identification entries in Scirius Security Platform
- hostidfilter: filter query on host matching a request done in host identification entries
- stamusthreatfilter: resolves Stamus threat id to Stamus threat name
- hostidlookup: do ip to hostname resolution and reverse using host identification data