NodeZero Add-on for Splunk
Overview
Details
This Add-on allows NodeZero users to ingest pentest results directly into Splunk, merging insights gained from the attacker's perspective with existing data and workflows in Splunk.
Pre-Requisites
NodeZero API Key
An API key is required to access the API. The key is tied to an existing user account with Org Admin privileges in the Horizon3.ai portal.
(At this time, API keys are manually provisioned by Horizon3.ai. If you don’t have an API key, please contact your Horizon3.ai representative to acquire one.)
Setup
Save API Key to Splunk credential store
On the Configuration page, click the Add button on the Accounts sub-tab
Nameis a simple name that gets used by theInputspageDescriptionis for any notes/details about the API Key/AccountAPI Keyis an encrypted field for saving the NodeZero API Key
Create the Input
On the 'Inputs' tab, click "Create New Input"
Name(required) is a simple name that gets used by the modular inputDescription(optional) is for any notes about the modular inputAPI Account(required) is a dropdown single select to choose the account for which you wish to pull dataIndex(required) the index to which you would like to ingest NodeZero dataPolling Interval(optional) Default is 86400 seconds (daily). How frequently you want to poll for new data
Once the input is saved, it immediately begins attempting to pull data from the NodeZero API
Verify data is being indexed
To make sure the modular input is doing its job, you can run the following search:
index=<index_you_chose_for_input> sourcetype=h3* | stats values(sourcetype) as stYou should see three sourcetypes:
h3:nodezero:api:action_logs
h3:nodezero:api:host_export_csv
h3:nodezero:api:weakness_export_csvThere is also a non-navigable dashboard at /en-US/app/TA_nodezero/kvstore_state that will show a table based on the KVstore the modular input uses to store app state. This can be used during troubleshooting to see what data has been pulled for each pentest.
Troubleshooting
For troubleshooting information, view ExecProcessor logs and the nodezero logs:
index=_internal (sourcetype=splunkd nodezero component=ExecProcessor) OR sourcetype="*nodezero*"Note: Don't forget the asterisks for sourcetype=*nodezero*, as it often shows as either ta_nodezero-too-small or ta_nodezero.
For more logs: set LOGGING to DEBUG in the Configuration tab
Support
Email splunk@horizon3.ai with any questions, comments, or concerns. Feedback is greatly appreciated!