Splunk Out-of-the-Box SecOps integration

The Splunk Out-of-the-Box SecOps Integration with the Lumu Splunk Add-on allows you to poll and push adversary-related events to your Splunk deployment. After configuring the integration, installing, and deploying the Lumu Splunk Add-on, your Splunk deployment will be able to receive and process Lumu events. By using it, you will be able to see adversarial activity detected by Lumu, giving more visibility to your Security Operations team.

Requirements

To integrate Lumu with your Splunk deployment you need:

Lumu Insights or Defender tier.
Splunk 8.2+ or Cloud edition.
The Lumu Add-on app from Splunkbase

Lumu Splunk Add-on works better with the Splunk Common Information Model (CIM). We encourage you to deploy this app if you haven’t already done so.

Add integration

1. Log in to your Lumu account through the Lumu Portal and navigate to the integrations screen.

2. Locate the Splunk integration in the Available Apps area under the SecOps category. Add the integration using the corresponding option to view more details. Familiarize yourself with the integration details available in the app description. Begin the activation process by clicking on the Activate button.

3. Fill in the name of the integration. Then, click on Create.

4. Once you create the integration, you will get the required information to configure the Lumu Splunk Add-on.

Take note of the Integration Key. It will be needed for configuring the Lumu Add-on for Splunk.

Setting up the Lumu Splunk Add-on

After adding the integration, you need to set up the Lumu Add-on for Splunk. Follow these steps to do it.

The latest version of the Lumu Splunk Add-on introduces Lumu's new detections and a new data model. If you added custom searches or other Splunk artifacts based on the 1.1.6 or earlier versions of the add-on, ensure you analyze the data model changes in a test environment before updating the add-on in your production environment.

Installing the Lumu Splunk Add-on

First, you need to install the Lumu Add-on for Splunk. To do so, you have these alternatives:

1. Find and download the add-on from the Splunkbase App portal. Install the package in your Splunk deployment.
2. Use the Find more apps menu from the Apps in your Splunk deployment.

For further reference check the About installing Splunk add-ons documentation.

Familiarize yourself with the Lumu Splunk Add-on interface before proceeding.

The navigation bar has the following menus:

Lumu dashboard: Presents relevant charts, displaying statistics about your Lumu operational environment
Search: Shows a search module to operate with Lumu events
Inputs: Allows you to manage the different Lumu sources you have in your Splunk deployment
Configuration: Allows you to change global configuration parameters, such as setting a proxy or changing the add-on logging level.

Adding a new Lumu input

After installing the Lumu add-on for Splunk, you need to add a new Input. Within the Lumu Defender app, click on the Inputs tab. Then, click on the Create new input button. Finally, fill in the requested data following these indications.

Name: Give a distinctive name to the source. If you deploy different sources, you can name each source as the related company/tenant from the Lumu portal
Interval: Set the time in seconds you want to run the integration script. The recommended interval is 30 seconds
Index: Define the index you want to use to store the indexed events
API key: Paste here the integration key from previous steps
Events of interest: Select the events you want to process for the created input. We recommend using the default value.
Include muted updates: You can choose whether you want to process updates received from muted incidents. By default, these messages are ignored.

The Lumu Splunk add-on can process detection-related events and operational events. The detection-related events are those generated when Lumu detects a new incident or a new event related to an existing incident. The operational events are those related to changes in the status of an incident (muting, unmuting, or closing an incident) or automatically triggered responses.

The name value can be used in the Lumu dashboard to filter data from a specific input/tenant.

Based on the detections raised by Lumu and the configured events, your new input will be populated with data. To check the events collected by the Lumu add-on, you can use the Search & Reporting app in your Splunk console or the Search tab in the Lumu Add-on. Run the following search to view all events Splunk has processed related to Lumu.

sourcetype=”lumu”

Operate the Lumu add-on for Splunk

After configuring your Lumu add-on for Splunk and generating events, you will have the following results:

Lumu Dashboard

The Lumu Dashboard will allow you to check at a glance all the information related to Lumu detections collected by the new input. Find it in the Lumu Dashboard tab under the Lumu Defender app.

In this dashboard you can change:

Global Time Range: modify the effective time range for the search
Tenant: If you have more than one input, you can select specific tenants. All tenants option is selected by default

Search tab

You can use the Search tab in the Lumu Defender app to run searches and work with collected events. Familiarize yourself with the fields collected by the add-on to run tailored searches. The Lumu Splunk Add-on maps the collected events to the Splunk Common Information Model (CIM), specifically to the Alerts model for Lumu detection-related events, and the Change model for Lumu operational events.

For example, you can use the following search to collect Lumu alerts:

| datamodel Alerts search | search sourcetype="lumu" | table _time, Alerts.app, Alerts.id, Alerts.signature, Alerts.src, Alerts.src_type, Alerts.dest, Alerts.dest_type

Your results should look as follows.

For operational events, you can use the following search:

| datamodel Change search | search sourcetype="lumu" | table _time, All_Changes.app, All_Changes.object, All_Changes.action, All_Changes.change_type, All_Changes.status

Your results should look as follows.

Troubleshooting

Here, you will find common scenarios found in the operation of your Lumu Splunk add-on.

Data is not visible in Splunk

If you are not seeing any event data in your Splunk deployment, you can run the following in the Search & Reporting app:

index=_internal sourcetype=talumu:log

If you need to increase the verbosity level, please modify the Log level under the Configuration tab in the Lumu Defender app.

In this log, you can identify specific issues with data collection, wrong credentials, and related.

Lumu dashboard not showing any data

If your deployment is receiving data but the Lumu dashboard does not show updated charts, you may be using a dedicated index to store Lumu events and your user does not have it included in the default indexes.

To check this, follow these steps:

1. Using the Search window, run the following search.
sourcetype=lumu
The result must look as follows:

2. Run this new search.
index=* sourcetype=lumu
You will see events in your search console:

3. Check the index name by expanding one of the events. Keep this in mind for the next configuration steps.
4. Modify the user roles to include the identified index in their defaults. Go to Settings > Roles menu, using an administrator user. Select the role you need to edit.
5. In the Edit Role window, go to the Indexes tab Look for the required index in the list, and make sure the Default field is enabled for the index record. Then, save the changes.

After running these steps, go back to the Lumu dashboard. You will be able to see data.

This process must be run for each role in your Splunk deployment to guarantee Lumu dashboard can access the required index to show data. Also, even when Splunk users receive all available permissions, there may be cases where the Lumu data index must be added to each role. You can find more information in the Splunk Users and Roles documentation.

Further Steps

After the integration process is done, you can define your own rules and dashboards. You can use the raw data from events to define alerts and so on based on your specific needs.