Creating Token in Cyberint
In order to establish integration between Cyberint and Splunk via API, it is necessary to generate an API Token.
Authorization for access to the Cyberint API is granted through the use of API access tokens.

Access your Cyberint instance by visiting https://<yourcompany>.cyberint.io.
Click on your profile image, and select USER SETTINGS.
Click the three dots on the upper right-hand side, and select Generate API Token.
After generating the token, securely store it in a safe location.

Installation of Cyberint Argos Edge integration for Splunk (Cloud & On-prem):
Prerequisites:
Before you proceed with the installation of the Cyberint Argos Edge integration for Splunk, ensure that you have the following prerequisites in place:
Splunk Version: Your Splunk instance should be version 9.0 or later.
Cyberint Argos Edge Integration for Splunk Content Pack: Ensure you have obtained the necessary content pack.
Cyberint API Communication: Splunk should be able to communicate with your Cyberint API directly, typically on port 443.

** For Cloud instances User should install from Splunkbase.

Installation Steps (On-prem) -
1. Login into Splunk.
2. Click on the Manage Apps button inside the Apps sidebar.
3. Click on the “Install app from file” button in the upper right corner.
4. Click on “Choose File” and select the provided application file. Then, click on the “Upload” button.
5. The application should be installed! Go to the homepage and notice the new Cyberint tab
6. Inside the Apps sidebar.

Cyberint Argos Edge integration for Splunk Configuration:
Open the Cyberint App
Log in to your Splunk instance with administrator privileges.
In the Splunk Web Interface, click on "Apps" in the left-hand sidebar.
Locate and click on the " Cyberint Argos Edge V2 integration for Splunk" app to open it.

Configure Account Settings (Add new account with Cyberint token)
*The Configuration tab allows you to customize the app by configuring accounts and logging settings.
5.1 In the Configuration tab, click on the "Account" sub-tab.
5.2 Here, you can efficiently manage your account settings, including securely storing your API tokens in Splunk's secret management.
5.3 Configure the following parameters for your account:
5.3.1 Name: Provide a unique name for your account.
5.3.2 API Token: Enter your Cyberint API access token.
Configure Input Settings (Add new input with already existing account)
6.1 Click on the "Inputs" tab.
6.2 To create a new input, click on the "New Input" button.
6.3 Configure the following parameters for your new input:
6.3.1 Name: Enter a name for the data input.
6.3.2 Instance Domain: Enter the Cyberint instance domain on which the services run (e.g., https://{environment}.cyberint.io/...).
6.3.3 Environment: Provide the Cyberint environment (in case you have multiple environments).
6.4 Additional Input Parameters:
*Types: Specify specific types of threats reported in the alert. Choose from the provided list of threat types.
Severities: Set the severity of the alert, indicating the potential impact on the target organization's business. Choose from "low," "medium," "high," or "very_high."
Statuses: Define the current status of the alert. Choose from "open," "acknowledged," or "closed."
Start Time: Provide the last time that the alert was modified.
Interval: Specify the number of seconds to wait before running the command again.
Include CSV Attachments: Determine whether CSV content files related to the alert should be included in the alerts. Set it to "true" to receive CSV attachments with additional data, enhancing the alert information.
6.5 Save and Apply Changes

That's it! You've successfully configured the Cyberint App in Splunk to integrate threat intelligence data from Cyberint into your Splunk environment for improved security monitoring and analysis.

Cyberint Argos Edge V2 integration for Splunk

0