Splunk Setup for Workbench

Prerequisites

1. Expel needs access to the Splunk device or instance through port 8000 (UI) and 8089 (API). For cloud instances, follow the Splunk Configure IP Allow List instructions to grant Expel these access privileges:

   • Search head API access
   • Search head UI access
2. Add Expel's egress IP addresses to your IP allow list. All requests to rest API come from one of these IP addresses. If you skip this step, this configuration only allows access to your Splunk environment from the Expel infrastructure.

Step 1: Enable Splunk Console Access

Expel requires console access to allow analysts to perform investigation and triage. Without this additional level of information, alerts cannot be verified by our analysts, and an investigation cannot be initiated. For more information, see Why Expel Asks for Console Access.

1. Log into Splunk.
2. Navigate to Settings > Access Controls > Users.
3. Select Add new.
4. Complete the fields:

   • Name - enter "Expel".
   • Full name - enter "Expel SOC".
   • Email address - enter "soc+<Your_Organization_Name>@expel.io".

     • For example, if your organization were Acme Corp, the format would be "[e-mail]".
   • Password - provide a password.
   • Time Zone - select GMT (or UTC).
   • Assign roles - select User.
   • Require password change on first login - clear this option.
5. Select Save.
6. Before moving on to the next section, make sure to give this newly created user permissions to view the Notable index and the Notable macro. If you need help completing this step, refer to the Splunk documentation.

Step 2: Retrieve and Provide a List of Indexes and Source Types

Providing Expel with a list of indexes and sourcetypes for your Splunk environment will allow us to query your data more efficiently.

1. From Spunk Home, select Search & Reporting in the Apps panel.
2. In the Search field, enter this string:

   | tstats values(sourcetype) where index=* by index

3. Select the Search icon to return results.
4. In the toolbar beneath the search bar, choose an option to export the search results in PDF, Raw Events, or CSV format.

   

Step 3: Add Splunk as a Security Device in Workbench

Now that you have the correct access configured and have noted the credentials, you can integrate your technology with Workbench.

1. Log in to Workbench.
2. In the side menu, navigate to Organization Settings > Security Devices.
3. Select Add Security Device.
4. In the search field, type “Splunk” and then select the Splunk integration.

   
5. If your installation is on premises (On-prem), then select the Assembler connected to the Splunk device. This is the assembler you set up in Add a New Assembler. Otherwise, choose Cloud.

   
6. Complete the fields as follows:

   

• Name - enter a name that might help you more easily identify this integration, such as “CompanyName Splunk”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
• Location - enter the location of your integration, for example, “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
• Username - enter the username for the user you created in Step 1.
• Password - enter the password you created in Step 1.

Expel manages Basic authentication by passing the Splunk username and password combination in an API request. The following code snippet shows how these values are passed:

import splunklib.client as client
service = client.connect(host=<host_url>, username=<username>, password=<password>, autologin=True)

Expel also supports Splunk API tokens for non-Basic authentication support, which you can create using Splunk documentation.

• Splunk Enterprise Security instance? - leave this blank.

Splunk Enterprise Security alerts require review by Expel before enabling. Contact Expel support for details.

• Server address:

  • Cloud - enter the Splunk server address and port 8089. For example: https://.splunkcloud.com:8089
  • On-prem - enter the Splunk console IP address and port 8089. For example: https://10.10.10.10:8089/

1. Select Save.
2. On the console access screen, select Set up now.
3. In the Console Login area, enter these details:

   • Console URL

     • For cloud, enter the Splunk server address and port. For example, https://splunkcloud.com:8089
     • For on-prem, enter the Splunk console IP address and port. For example, https://10.10.10.10:8089/ .
   • Username - enter the username for the user you created in Step 1.
   • Password - enter the password you created Step 1.
   • Two-factor secret key (32-character code): depending on how your organization enforces logins, this field may not apply to you. In these cases, you can leave it blank. This field is optional and if you have questions or concerns, contact support.
4. Select Save.

Your device should be created successfully within a few seconds. A few reminders:

• After your connection is healthy, it will take some time for your device to begin polling and receiving data.
• To check on the status, select the downward arrow for your device in the first column and choose View details.
• Polling will happen first; data will be received after that. You must refresh the page to see updates.
• If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, contact our support team for help.
• To check if alerts are coming through, navigate to Dashboards > Alert Analysis. Scroll to the device you want to check, and select the Expel Alerts tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we tune your device.

Additional Criteria for Support

The actions below improve our ability to normalize custom alerts so they are properly presented in Workbench. They also equip our analysts with necessary context so they can make informed decisions.

CIM Compliance To properly display alert evidence in Workbench, fields must be normalized according to Splunk's Common Information Model. Expel only uses a portion of the 500 CIM fields available for alert normalization. Expel uses version 6 of CIM Compliance.

Proper normalization also enables Ruxie to perform automated actions on the alert. We rely on proper normalization to create detections, suppressions, bloom for detections (alert deduplication), BOLOs, and in-depth DUET messages. If a CIM field isn't being used and is requested to be a part of alert normalization or DUET messages, then we typically can't support the request.

Please review the fields being returned from Splunk searches to ensure they map to what is shown in Splunk's Common Information Model Add-on Manual.

Use the Description Field Any additional information about the custom rule that may be useful for our analysts should be included in the Description. Examples include the detection’s intent and suggested steps to triage.