Start Demo

Integrate RevealX 360 with Splunk Enterprise Security SIEM

This integration enables the Splunk Enterprise Security SIEM to export device and detection data from the ExtraHop system through detection notification rules. You can view exported data in the SIEM to gain insight into how your devices are communicating in your environment and to view network threat detections.

This integration requires you to complete two tasks. An ExtraHop administrator must configure the connection between the SIEM and the ExtraHop system. After the connection is established, you can create detection notification rules that will send webhook data to the SIEM.

The detection notification rules associated with this integration are available from the integration configuration page as well from the Notification Rules table that you can access from System Settings.

Before you begin

You must meet the following system requirements:

  • ExtraHop RevealX 360
    • Your user account must have privileges on RevealX 360 for System and Access Administration.
    • Your RevealX 360 system must be connected to an ExtraHop sensor with firmware version 9.8 or later.
    • Your RevealX 360 system must be connected to ExtraHop Cloud Services.
  • Splunk
  1. Log in to RevealX 360.
  2. Click the System Settings icon and then click Integrations.
  3. Click the Splunk Enterprise Security (SIEM) tile.
  4. Complete the following steps to configure the connection between the Splunk Enterprise Security SIEM and the ExtraHop system:
    1. In the Ingest Host field, type the URL or hostname of the SIEM server that will receive webhook data.
    2. In the Ingest Port field, type the port number that will receive webhook data.
    3. In the Index field, type the name of the index that will store the webhook data.
    4. In the HEC Token field, type the token that will authenticate the connection to the ingest host.
  5. Select one of the following connection options:
    Option Description
    Direct Connection Select this option to configure a direct connection from this RevealX 360 console to the provided URL.
    Proxy through a connected sensor Select this option if your SIEM cannot support a direct connection from this RevealX 360 console due to firewalls or other security controls.
    1. From the drop-down menu, select a connected sensor to act as the proxy.
    2. (Optional): Select Connect through the global proxy server configured for the selected sensor to send data through a global proxy. (Only available if the selected sensor is running RevealX Enterprise.
  6. Click Send Test Event to establish a connection between the ExtraHop system and the SIEM server and to send a test message to the server.
    A message is displayed that indicates whether the connection succeeded or failed. If the test fails, edit the configuration and test the connection again.
  7. (Optional): Select Skip server certificate verification to bypass verification of the SIEM server certificate.
  8. Click Save.

Create a detection notification rule for a SIEM integration

Before you begin

  • Your user account must have NDR module access to create security detection notification rules.
  • Your user account must have NPM module access to create performance detection notification rules.
  • You can also create detection notification rules from System Settings. For more information, see Create a detection notification rule.
  1. Log in to RevealX 360.
  2. Click the System Settings icon and then click Integrations.
  3. Click the tile for the SIEM that will be the target of the detection notification rule.
  4. Click Add Notification Rule.
    The Create Notification Rule window opens in a new tab and the following fields are set to default values.
    • The Name field is set to the name of the SIEM.
    • The Event Type field is set to Security Detection.
    • The Target field is set to the SIEM integration.
  5. In the Description field, add information about the notification rule.
  6. In the Criteria section, click Add Criteria to specify criteria that will generate a notification.
    • Recommended for Triage
    • Minimum Risk Score
    • Type
    • Category
    • MITRE Technique (NDR only)
    • Offender
    • Victim
    • Device Role
    • Participant
    • Site
    The criteria options match the filtering options on the Detections page.
  7. Under Payload Options, select if you want to send the default payload or type in a custom JSON payload.
    If you selected to send notifications once per detection under Notification Behavior, you must send a custom payload.
    • Default payload

      Populate the webhook payload with a core set of detection fields.

      From the Add Payload Fields dropdown, you can click additional fields that you want to include in the payload.

    • Custom payload

      Populate the webhook payload with custom JSON.

      You can edit the suggested custom payload in the Edit Payload window. window.

  8. Click Test Connection.
    A message titled Test Notification will be sent to confirm the connection.
  9. In the Options section, the Enable notification rule checkbox is enabled by default. Deselect the checkbox to disable the notification rule.
  10. Click Save.

Next steps

  • Navigate back to the integration configuration page to check that your rule has been created and added to the table.
  • Click Edit to modify or delete a rule.
Last modified 2024-11-19