AMP for Endpoints Integration with Splunk · Caution:€This information cannot be recovered by any...

8
AMP for Endpoints Integration with Splunk Contents Introduction Prerequisites Requirements Components Used Configure Troubleshoot Introduction This document describes the integration process between Advanced Malware Protection (AMP) and Splunk. Contributed by Uriel Islas and Juventino Macias, Edited by Jorge Navarrete, Cisco TAC Engineers. Prerequisites Requirements Cisco recommends that you have the knowledge of: AMP for Endpoints ● Application Programming Interface (API) ● Splunk ● Admin user on Splunk ● Components Used AMP Public Cloud ● Splunk instance ● The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command. Configure Step 1. Navigate to AMP console (https://console.amp.cisco.com) and navigate to Accounts>API Credentials, where you can create event streams.

Transcript of AMP for Endpoints Integration with Splunk · Caution:€This information cannot be recovered by any...

  • AMP for Endpoints Integration with Splunk Contents

    IntroductionPrerequisitesRequirementsComponents UsedConfigureTroubleshoot

    Introduction

    This document describes the integration process between Advanced Malware Protection (AMP)and Splunk.

    Contributed by Uriel Islas and Juventino Macias, Edited by Jorge Navarrete, Cisco TACEngineers.

    Prerequisites

    Requirements

    Cisco recommends that you have the knowledge of:

    AMP for Endpoints●

    Application Programming Interface (API)●

    Splunk ●

    Admin user on Splunk●

    Components Used

    AMP Public Cloud●

    Splunk instance ●

    The information in this document was created from the devices in a specific lab environment. All ofthe devices used in this document started with a cleared (default) configuration. If your network islive, make sure that you understand the potential impact of any command.

    Configure

    Step 1. Navigate to AMP console (https://console.amp.cisco.com) and navigate to Accounts>APICredentials, where you can create event streams.

    https://console.amp.cisco.com/dashboard

  • Step 2. In order to perform this integration, mark the Read & Write checkbox as shown below:

    Note: If you would like to collect more information on the events, check the EnableCommand Line box, to get the Audit Logs generated from the File Repository check theAllow API access to File Repository box.

    Step 3. Once you create the event stream it would display the API Client ID and API Key which isrequired on Splunk.

  • Caution: This information cannot be recovered by any means, in case of loss, a new APIKey must be created.

    Step 4. In order to integrate Splunk with AMP for endpoints, ensure that the account Admin existson Splunk.

    Step 5. Once you log in on Splunk, proceed to download AMP from Splunk Apps.

  • Step 6. Search for Cisco Endpoint on the App browser and install it (Cisco AMP for EndpointsEvents Input).

    Step 7. A restart of the session is required to complete the installation on Splunk.

    Step 8. Once you log in under Splunk, click on Cisco AMP For Endpoints on the left side of thescreen.

    Step 9. Click on the Configuration label at the top of the screen.

  • Step 10. Type your API credentials previously generated from the AMP console.

    Note: The API Host spot might be different based on the Cloud Data Center that yourorganization points at: North America: api.amp.cisco.com Europe: api.eu.amp.cisco.com APJC: api.apjc.amp.cisco.com

  • Step 11. Include and save API credentials on the Splunk console to link them with AMP.

    Step 12. Go back to Input to get your event stream created.

  • Note: If you want to get all the events for all the groups from AMP, leave Event Types andGroups fields blank.

    Step 13. Ensure that your input was successfully created.

    Note: Please keep on mind that this integration is not officially supported

  • Troubleshoot

    If while you create an event stream all the fields are greyed out, that could be caused for some ofthe reasons below:

    Connectivity Issues: Ensure that Splunk instance is able to contact the API host1.API Host: Ensure that the API host configured on step 10 match with your AMP organization,based on where your business points at.

    2.

    API credentials: Ensure that the API Key and Client ID match with the ones configured onstep 3.

    3.

    Event Streams: Ensure that you have less than 4 event streams configured.4.

    AMP for Endpoints Integration with SplunkContentsIntroductionPrerequisitesRequirementsComponents Used

    ConfigureTroubleshoot


Netfilter Iptables for Splunk Documentation - Read the Docs · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users

Netfilter Iptables for Splunk Documentation - Read the Docs · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

THE SPLUNK GUIDE TO OPERATIONAL …...Splunk Guide to Operational Intelligence 2 The Splunk Approach Splunk Enterprise is the first enterprise-class platform that collects and indexes

THE SPLUNK GUIDE TO OPERATIONAL …...Splunk Guide to Operational Intelligence 2 The Splunk Approach Splunk Enterprise is the first enterprise-class platform that collects and indexes

Intégration d'AMP for Endpoints avec Splunk · d'événements Cisco AMP for Endpoints). Étape 7. Un redémarrage de la session est nécessaire pour terminer l'installation sur Splunk.

Intégration d'AMP for Endpoints avec Splunk · d'événements Cisco AMP for Endpoints). Étape 7. Un redémarrage de la session est nécessaire pour terminer l'installation sur Splunk.

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad itinnovation@contacts.bham.ac.uk Indexing 2.2.1 Searching using splunk Splunk uses

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

PearsonCorrelation (Recovered 1) (Recovered)

PearsonCorrelation (Recovered 1) (Recovered)

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

Security Investigation and Rapid Response Using Splunk and ... · Enter Splunk Splunk Enterprise and Splunk Cloud provide an analytics-driven approach to security on the AWS Cloud

Security Investigation and Rapid Response Using Splunk and ... · Enter Splunk Splunk Enterprise and Splunk Cloud provide an analytics-driven approach to security on the AWS Cloud

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Caribbean Studies - Recovered - Recovered - Recovered

Caribbean Studies - Recovered - Recovered - Recovered

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Our experiences throughout the 3 year journey · Splunk – Hardware is now available for Splunk expansion • Splunk begins to fill monitoring gaps, acts as “glue” • Splunk

Our experiences throughout the 3 year journey · Splunk – Hardware is now available for Splunk expansion • Splunk begins to fill monitoring gaps, acts as “glue” • Splunk

Poster_IIC [Recovered] [Recovered]

Poster_IIC [Recovered] [Recovered]