BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Getting Retina Data into Splunk

Posted March 21, 2014    Jason Williams

SIEM products do a great job correlating information from a laundry list of security and operational solutions in order to gain visibility and context within an IT environment. Today we are going to show how to forward Retina Network security data into Splunk to help improve visibility and decision making. This integration can be completed in two simple steps.

Step 1

The first step you need to configure is on the Retina Network Security Scanner itself (RNSS). Once you have logged onto RNSS, go to the top menu -> Tools -> Alerting.

See the screenshot below:

Img1

Once you click on the ‘Alerting’ option, you will see the following ‘Events’ list:

Img2

The ‘events’ list is where you define what information you want Retina Network Scanner to send over to Splunk. In my case here, I am sending over “Medium Risk Audit” as well as “High Risk Audit” alerts. With these options selected, anytime Retina Network Scanner performs a vulnerability scan, anytime it discovers a High or Medium Risk audit, it will send that information over to my Splunk server.

Once you have selected the events you want RNS to send over, click on the ‘Actions’ tab as seen in this screenshot:

Img3

In this section of the ‘alerting’ process, we are going to focus on the ‘SYSLOG’ section.
The syslog section is where we are going to configure RNS to send our data over to our Splunk box via SYSLOG.
Make sure you define the following sections in the SYSLOG section:

Enabled: True   (This enables RNS to send data over via syslog)
Host:     <IP address or hostname of splunkbox>  — This is where RNSS is going to send the data to
Priority: By default, you can keep this as “LOG_INFO”. This should be sufficient to get our data into Splunk.
Facility: This can also be kept as “LOG_LOCAL0”.

Once you have completed these steps on RNS, we have completed all we need to do on the Retina side.
The next step is to configure Splunk to accept data from our RNSS.

Step 2

Once you have the data in Splunk, you can use Splunk’s searching capabilities to sort through the data forwarded from that Retina Network Scanner.

Setting up Splunk is pretty straightforward. We are going to setup Splunk to accept SYSLOG activity via UDP on port 514 (standard syslog port).
There are several ways to set this up in Splunk. Here is a one way to setup the connection in Splunk:

Img4

Once you have Splunk accepting SYSLOG logs over UDP port 514, you can now start sending Retina Scan information to Splunk. Once you have ran your vulnerability scans, that data will now be consumed by Splunk, allowing you to view, sort and filter on the Vulnerability data.

Here is a screenshot of all the data that has been sent over to Splunk from RNSS.

Img5

 Here is another screenshot where we are focusing specifically on the host, 192.168.47.110:

Img6

Here is one more example of sorting on a vulnerability and finding it on multiple hosts. In the below example, I am focusing on “Mozilla” vulnerabilities and as we can see from the results returned back, I have two machines that have this known vulnerability:

192.168.47.141
192.168.47.110

Img7

Now that you have successfully configured RNSS (Retina Network Security Scanner) to send vulnerability scan information to Splunk, it is very easy and flexible to search through the data and find information very quickly.

Tags:
, , , , , ,

Leave a Reply

Additional articles

PowerBroker Password Safe Password Age Report

Reshaping Privileged Password Management with Password Safe 5.2

Posted July 21, 2014    Martin Cannard

Today, we’re pleased to unveil the latest edition of our privileged password management solution, PowerBroker Password Safe. I’ll start with a brief intro of what’s new and then tell you a little about the driving factors behind Password Safe development. New features for mitigating password risk and ensuring accountability enterprise-wide Here’s the 10,000-foot overview of…

Tags:
, , ,
PowerBroker for Windows tamper protection

PowerBroker for Windows 6.6 Tamper Protection

Posted July 18, 2014    Morey Haber

I have a bone to pick: Stopping an administrator from performing an action on a system is futile endeavor. As an administrator, there is always a way to circumvent a solution’s from tampered protection. Really! By default, Windows administrators have unrestricted access to the system – and even though an application, hardened configuration, or group policy…

Tags:
, ,
PowerBroker for Windows can be configured to automatically identify the end user’s language preference

Implementing Least Privilege Around the World with PowerBroker for Windows

Posted July 17, 2014    Morey Haber

BeyondTrust recognizes that international, multilingual businesses have unique operating challenges, especially when it comes to implementing enterprise software. PowerBroker for Windows is a least-privilege solution often deployed across thousands of systems spanning multiple geographies and protecting users of diverse backgrounds. Earlier this year, PowerBroker for Windows introduces new data privacy features for EMEA and APAC,…

Tags:
, ,