Reach Security App For Splunk

This is an app powered by the Splunk Add-on Builder

OVERVIEW

The Reach Security App For Splunk works with your Reach security products and can be instantly deployed on top of your Splunk implementation, allowing you to easily collect and share the information with Reach. The information collected enables Reach to help you and your team answer key strategic questions regarding risk in the organization and how best to configure and operate your current security investments to mitigate risk facing the organization.

Here is the functionality you can expect to find when using the Reach Security App For Splunk:
* Search, anonymize and export specific identity and security event logs from Splunk to Reach.
* Choose to download identify and security event logs from Splunk as a csv zip archive locally to be shared with the Reach product

Prerequisites - Require data collected from the apps specified below:

• Active Directory Data: https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorActiveDirectory
• Proofpoint TAP Data: https://splunkbase.splunk.com/app/3681
• Palo Alto Networks PAN-OS Data: https://splunkbase.splunk.com/app/2757

RELEASE NOTES

• Version 1.0.0
• Welcome Dashboard
• Configuration Screen
• Export Dashboard
  • Allows the user to take actions to export necessary data and package it up for download and delivery to the Reach
  • product (for triggering search and anonymize data). User can also download the anonymized zip file from the same
  • screen
• Troubleshooting

RECOMMENDED SYSTEM CONFIGURATION

• Splunk system should have 12 GB of RAM and a six-core CPU to run this application smoothly.

TOPOLOGY AND SETTING UP SPLUNK ENVIRONMENT

This application can be set up in two ways:

1) Standalone Mode: Install the App on a single machine. This single machine would serve as a Search Head + Indexer + Heavy forwarder for this setup
2) Distributed Environment: Install App on search head for executing the search functionality.

INSTALLATION

Follow the below-listed steps to install an Add-on from the bundle:

1) Download the App package.
2) From the UI navigate to Apps->Manage Apps.
3) In the top right corner select Install app from file.
4) Select Choose File and select the App package.
5) Select Upload and follow the prompts.
6) We recommend you restart Splunk. Once Splunk has been restarted you may enjoy your new app!

UPGRADE

Follow the below steps when upgrading from Reach Security App For Splunk

1) From the UI navigate to Apps->Manage Apps.
2) In the top right corner select Install app from file.
3) Select Choose File and select the App package.
4) Check the upgrade option.
5) Select Upload and follow the prompts.
6) Restart Splunk.

TROUBLESHOOTING

The configuration page is not loading

• Check log file for possible errors/warnings: $SPLUNK_HOME/var/log/splunk/splunkd.log

Download button is not clickable on Export dashboard

• Go to Search tab. Hit the following query index="_internal" source="*reach*" and check the results.
• Verify the filters configured during data collection are valid and such events exist on the platform.
• Check the log file related to data collection is generated under $SPLUNK_HOME/var/log/splunk/reach_single_execution.log or $SPLUNK_HOME/var/log/splunk/reach_periodic_execution.log.
• To get the detailed logs, in the Splunk UI, navigate to Reach Security App For Splunk. Click on Configuration and go to the Logging tab. Select the Log level to DEBUG.
• Check the logs. There will be more verbose and will give the user insights on search execution.

If you are not seeing file name on Export dashboard in case of Load balancer

• Click on execute button for re-executing the search for creating csv zip file

If the Splunk Instance is behind a proxy, Configure Proxy settings by navigating to Reach Security App For Splunk -> Configuration -> Proxy

Facing performance issue and taking time for creating csv zip files

• In case of facing issue in performance, user can reduce the fields added in two property named fields_to_anonymize and result_fields in the conf file(reach_security_app_for_splunk_settings.conf)
• After reducing the number of fields, Restart the Splunk

UNINSTALL APP

To uninstall app, user can follow below steps: SSH to the Splunk instance Go to folder apps($SPLUNK_HOME/etc/apps) Remove the reach_security_app_for_splunk folder from apps directory Restart Splunk

Copyright (C) 2020 Reach Security, Inc. All rights reserved.