Giter VIP home page Giter VIP logo

wwt / csna Goto Github PK

View Code? Open in Web Editor NEW
4.0 2.0 1.0 1.27 MB

Cisco Secure Network Analytics (formerly Stealthwatch) app for Splunk SOAR (formerly Splunk Phantom). Refer to the Splunk and Cisco product documentation on installation and configuration of the respective platforms. After installing this app in Splunk SOAR, refer to the documentation for configuration and use.

License: Apache License 2.0

Dockerfile 2.94% Python 97.06%
splunk soar stealthwatch cisco

csna's Introduction

csna

Cisco Secure Network Analytics (formerly Stealthwatch) app for Splunk SOAR (formerly Splunk Phantom)

Integrating Splunk SOAR and Cisco Secure Network Analytics

published

Asset Configuration

The asset definition requires these fields:

  • Userid
  • Password
  • Hostname / IP address
  • Tenant (Domain) display name

The Tenant (Domain) display name (displayName) is specified in the Management Console GUI and should be entered in the asset configuration. This enables creating an separate asset in Splunk SOAR for each Tenant (Domain). If you have a multi-domain system, You can create the same tag name for multiple assets and pass that tag to the act() function in playbooks. The action runs on all assets with that tag.

App Actions

This app implements these actions.

test connectivity

The test connectivity action is required of all apps. This action authenticates with the Management Console, verifying network reachability and a valid username and password. It does not validate the Tenant (Domain) exists on the Management Console. This validation step is a function of the retrieve flows action.

retrieve flows

The retrieve flows action uses the Stealthwatch Reporting - Version 2 API call to create flow searches and retrieve the searches' results.

To retrieve data, a start and end date and time must be calculated and a record limit specified (or a default value).

As an example, if the parameters specify:

"start_time": "2022-01-05T15:30:0Z",
"timespan": 60

The app calculates a flow filter with these values:

"startDateTime": "2022-01-05T15:30:00Z",
"endDateTime": "2022-01-05T16:30:00Z"

If no values are specified for start_time and timespan, the startDateTime is 60 minutes from the current time, and the endDateTime is the current time. Effectively returning data from the past hour.

The flow search uses an IP address specified by the user to bound the search filter.

With the above information, a POST command is sent with the search filter in the body of the request. The app waits for the results to be generated and returns the action_result.data results (if any). Additionally action_result.extra_data includes the flow query id (flow.query.id) and the search filter (flow.filter) generated from the parameters specified, along with all configured Tenant display names and IDs. The Tenant ID (tenantId) is also included in the result data.

References

How to Information

In addition to the DEVELOPMENT_NOTES.md file, there is an internal WWT Stream channel with video recordings of the working sessions. The channel name is Splunk> SOAR.

Author

Joel W. King @joelwking

csna's People

Contributors

joelwking avatar

Stargazers

 avatar  avatar  avatar  avatar

Watchers

 avatar  avatar

Forkers

adriaanvermaak

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.