Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to...

18
Integrating AVANAN with AWS S3 for Splunk logs - Part One Step-1: • Go to AWS IAM: https://console.aws.amazon.com/iam/home#/home Step-2: • Click on Users > Add user Step-3: • Select a name and enable “Programmatic access”, click “Next: Permissions”

Transcript of Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to...

Page 1: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Integrating AVANAN with AWS S3 for Splunk logs - Part One

Step-1: • Go to AWS IAM: https://console.aws.amazon.com/iam/home#/home

Step-2: • Click on Users > Add user

Step-3: • Select a name and enable “Programmatic access”, click “Next: Permissions”

https://console.aws.amazon.com/iam/home%23/home
Page 2: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-4: • Click on “Create group” (or the right group if already created)

Page 3: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-5: • Click on “Create policy” (or select the right policy if already created)

Page 4: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-6: • On the new tab, click on JSON and copy this over:

{ "Version": "2012-10-17", "Statement": [

{ "Effect": "Allow",

"Action": [ "s3:ListBucket" ],

"Resource": [ "arn:aws:s3:::YOUR_S3_BUCKET"

] }, {

"Effect": "Allow", "Action": [

"s3:GetObject", "s3:GetObjectAcl", "s3:PutObject"

], "Resource": [ "arn:aws:s3:::YOUR_S3_BUCKET/THE_LOG_FOLDER_IF_ANY/*"

] }

] }

Page 5: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

• For example:

Page 6: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-7: • Click on Review Policy

• On the next screen, select a policy name and click on “Create Policy”

Page 7: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-8: • After the policy is created, go back to the previous tab and click “Refresh” • Select the policy you just created, give the group a name and click on “Create group”

Page 8: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-9: • Back to the “Add user” screen, confirm that the group you just created is selected and click

on “Next: Tags”

Page 9: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-10: • Add the necessary Tags (in accordance with your environment directives) and click on

“Next: Review”

• Confirm all the configurations and click on “Create user”

• *Download the CSV or copy the Access Key and Secret access key somewhere safe. This

information won’t be available again. • Close.

Page 10: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-11: • Click on Roles and on “Create role” • Select Another AWS Account

• Insert the 12 digit number of the user you just created click on “Next: Permissions”

• Note: to find the 12 digit number, open the user on another screen:

Page 11: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-12: • Select the policy you created, click on Next: Tags

Page 12: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-13: • Add the necessary Tags (in accordance with your environment directives) and click on

Next: Review

Page 13: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-14: • Select a role name and click on Create Role

Page 14: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-15: • Search for the role you just created, click on its name.

Step-16: • Select “Trust relationships” and click on “Edit trust relationship”

Page 15: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-17: • Copy the following over and click on “Update Trust Policy”

{

"Version": "2012-10-17", "Statement": [ {

"Effect": "Allow", "Principal": {

"AWS": "arn:aws:iam::731485868276:user/avanan-s3-log-uploader" }, "Action": "sts:AssumeRole",

"Condition": { "StringEquals": { "sts:ExternalId": "avanan-s3-logs"

} }

} ] }

Page 16: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

• For Example:

Step-18: • Copy the Role ARN to use on the Avanan side

Page 17: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-19: • Back on Avanan, go to Configuration > Security App Store. • Find Splunk on the list and click on Configure (if the button is grey out, the module is not

enabled, click on the round “PLAY” button to enable it and refresh the page)

Page 18: Integrating AVANAN with AWS S3 for Splunk logs - Part One · > Select “Report security events to Splunk” if you want all new security events to be uploaded (recommended). > Select

Step-20: • Copy your Role ARN, bucket name, and select a region. Insert the subfolder you want the

logs to be uploaded to, if any (they will be uploaded to the root directory if left empty).

> Select “Report security events to Splunk” if you want all new security events to be

uploaded (recommended).

> Select “Include entity profile link” if you want to add a link to the entity profile on

Avanan to the JSON logs.

• Click on Ok to save. The Avanan-S3 side of the integration is done.


NetFlow Analytics for Splunk - netflowlogic.com · into Splunk Enterprise, and, optionally, all original flow records to inexpensive storage like Hadoop. The events are available

NetFlow Analytics for Splunk - netflowlogic.com · into Splunk Enterprise, and, optionally, all original flow records to inexpensive storage like Hadoop. The events are available

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Using*Splunk*to* Automacally** MiDgate*Threats*...11 SAJMiDgaon* MiDgaon* Correlaon* Searches* Incident Management(Index(Master* MiDgaon* Searches* Creates**Events* Pulls*Events* to*Block*

Using*Splunk*to* Automacally** MiDgate*Threats*...11 SAJMiDgaon* MiDgaon* Correlaon* Searches* Incident Management(Index(Master* MiDgaon* Searches* Creates**Events* Pulls*Events* to*Block*

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

Splunk Advanced Architectures - RainFocus · © 2018 SPLUNK INC. During the course of this presentation, we may make forward-looking statements regarding future events or the expected

Splunk Advanced Architectures - RainFocus · © 2018 SPLUNK INC. During the course of this presentation, we may make forward-looking statements regarding future events or the expected

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad itinnovation@contacts.bham.ac.uk Indexing 2.2.1 Searching using splunk Splunk uses

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

Splunk in Rakuten: Splunk as a Service for all

Splunk in Rakuten: Splunk as a Service for all

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk user group - automating Splunk with Ansible

Splunk user group - automating Splunk with Ansible

SPLUNK Capabilities Overview - GTRI · Overview GTRI is the only ELITE Splunk integrator with certified Splunk architects and engineers on staff. In addition to ... SPLUNK-Overview

SPLUNK Capabilities Overview - GTRI · Overview GTRI is the only ELITE Splunk integrator with certified Splunk architects and engineers on staff. In addition to ... SPLUNK-Overview

Splunk IT Service Intelligence - magellan-net.de · © 2017 SPLUNK INC. During the course of this presentation, we may make forward-looking statements regarding future events or the

Splunk IT Service Intelligence - magellan-net.de · © 2017 SPLUNK INC. During the course of this presentation, we may make forward-looking statements regarding future events or the

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring

Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Our experiences throughout the 3 year journey · Splunk – Hardware is now available for Splunk expansion • Splunk begins to fill monitoring gaps, acts as “glue” • Splunk

Our experiences throughout the 3 year journey · Splunk – Hardware is now available for Splunk expansion • Splunk begins to fill monitoring gaps, acts as “glue” • Splunk

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT