From 507dd396d295132bdf71f11c67fbcdf00701f7d0 Mon Sep 17 00:00:00 2001 From: "Mahir Chavda (C)" Date: Tue, 2 Jun 2020 16:30:44 +0530 Subject: [PATCH 1/4] More mcafee epo sample events --- tests/test_mcafee_epo.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tests/test_mcafee_epo.py b/tests/test_mcafee_epo.py index 69fab84..8d8df32 100644 --- a/tests/test_mcafee_epo.py +++ b/tests/test_mcafee_epo.py @@ -13,8 +13,12 @@ env = Environment() testdata = [ - '{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Windows 1024024224{{ iso }}POLICYAU6000040959Policy EnforcementN/AEPOAGENT3000N/AN/AN/A\n', - '{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Linux0GARY189050{{ iso }}Policy Auditor Vulnerability Assessment1.1.0Security020eJx1jjELgzAUhPf+ipCpBYWoS+smOHYQHEuR1xjKK+YZzEupiP+9j+7d7o7vuNs0gXe61l2jmhgd qxYYVG+BCOmprkjpo45N1/UnnemUcBS4NKIZvYsMPvyC0uSmyouLKqramLo8C7G4mCYeeA2ysGkI YUILjDMN8+PlLEsTyS7OO2KY9J6JfYuel3UY5ce/1u2+74cvff89lg==\n' + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.131Windows 10 Server%CTX_DOMAIN_USER%-330000011223311ENDP_GS_1060McAfee Endpoint Security10.6.1.1607DESKTOP-0000111200{{ iso }}_ops.update1none6', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.83Windows 10 Server%CTX_DOMAIN_USER%-330000011223311ENDP_GS_1070McAfee Endpoint Security10.7.0.1285DESKTOP-0000111180{{ iso }}_ops.update.end1none6', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.45Windows 10 WorkstationSYSTEM-330000011223311ENDP_WP_1060McAfee Endpoint Security10.6.1DESKTOP-00001URL navigation186003{{ iso }}wp.detect.url186002Web Control ViolationIDS_THREAT_TYPE_URL{{ iso }}ZblockedTrue213.211.198.58http://2222.aaaaa.org/download/eicarcom2.zipDESKTOP-00001\adminC:\Program Files\McAfee\Endpoint Security\Web Control\McChHost.exeDESKTOP-00001\adminIDS_BLADE_NAME_WPTrue03e33bcdd99853ea8c83407c3ab4599cC:\Program Files\Google\Chrome\Application\chrome.exea1902e39f3a1610751b707a6742082c3TrueGoogle LLC0FalseIDS_SECUIRTY_RATING_SA_REDIDS_SAE_CONTENT_MS1IDS_WC_NLD_URL_RATING|SourceURL=http://2222.aaaaa.org/download/eicarcom2.zip|SourceProcessName=C:\Program Files\McAfee\Endpoint Security\Web Control\McChHost.exe|SourceUserName=DESKTOP-00001\admin|ThreatActionTaken=blocked|AnalyzerName=McAfee Endpoint Security|SourceURLRatingCode=IDS_SECUIRTY_RATING_SA_RED186002222.aaaaa.orghttp://2222.aaaaa.org/download/eicarcom2.zip10413143444413000000100000000000000000011000000', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.131Windows 10 ServerSYSTEM-330000011223311ENDP_AM_1060McAfee Endpoint Security10.6.1DESKTOP-000016010.8670On-Access Scan3811.012783{{ iso }}av.detect12782EICAR test filetest{{ iso }}ZIDS_ALERT_ACT_TAK_DELTrueDESKTOP-00001C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\Tops.exeDESKTOP-00001DESKTOP-00001\admin123C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\TEST_SAMPLES_MVS\Standard Test Set\eicarIDS_BLADE_NAME_SPB2019-08-25T02:22:00ZFalseTrueeicarC:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\TEST_SAMPLES_MVS\Standard Test Sete7e5fa40569514ec442bbdf755d89c2f702000-10-24T05:13:46Z2019-08-26T05:32:39Z2019-08-26T05:32:39ZFalseIDS_OAS_TASK_NAMEIDS_ALERT_THACT_ATT_CLEFalseIDS_ALERT_THACT_ATT_DELTrue410IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=eicar|TargetPath=C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\TEST_SAMPLES_MVS\Standard Test Set|ThreatName=EICAR test file|SourceProcessName=C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\Tops.exe|ThreatType=test|TargetUserName=DESKTOP-00001\admin123IDS_OAS_DEFAULT_THREAT_MESSAGE3811.0', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Windows 1024024224{{ iso }}POLICYAU6000040959Policy EnforcementN/AEPOAGENT3000N/AN/AN/A', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Linux0GARY189050{{ iso }}Policy Auditor Vulnerability Assessment1.1.0Security020eJx1jjELgzAUhPf+ipCpBYWoS+smOHYQHEuR1xjKK+YZzEupiP+9j+7d7o7vuNs0gXe61l2jmhgd qxYYVG+BCOmprkjpo45N1/UnnemUcBS4NKIZvYsMPvyC0uSmyouLKqramLo8C7G4mCYeeA2ysGkI YUILjDMN8+PlLEsTyS7OO2KY9J6JfYuel3UY5ce/1u2+74cvff89lg==', ] @pytest.mark.parametrize("event", testdata) def test_mcafee_epo_structured(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s,event): @@ -27,7 +31,7 @@ def test_mcafee_epo_structured(record_property, setup_wordlist, get_host_key, se iso = dt.isoformat()[0:23] epoch = epoch[:-3] - mt = env.from_string(event) + mt = env.from_string(event + "\n") message = mt.render(mark="<29>1", iso=iso, host=host) sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) From 813760ed222f52865102393d8cceda9449bdaade Mon Sep 17 00:00:00 2001 From: "Mahir Chavda (C)" Date: Tue, 2 Jun 2020 16:31:43 +0530 Subject: [PATCH 2/4] Minor McAfee EPO document change --- docs/sources/McAfee/index.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/docs/sources/McAfee/index.md b/docs/sources/McAfee/index.md index 7659257..250d6e5 100644 --- a/docs/sources/McAfee/index.md +++ b/docs/sources/McAfee/index.md @@ -2,20 +2,18 @@ ## Product - EPO -Initial support for the syslog means of data collection is NOT supported by any -current Splunk TA; a custom TA is required | Ref | Link | |----------------|---------------------------------------------------------------------------------------------------------| -| Splunk Add-on CEF | none | -| Product Manual | unknown | +| Splunk Add-on | No Public add-on | +| Product Manual | https://kc.mcafee.com/corporate/index?page=content&id=KB87927 | ### Sourcetypes | sourcetype | notes | |----------------|---------------------------------------------------------------------------------------------------------| -| mcafee_epo | mcafee:epo:syslog sourcetype | +| mcafee:epo:syslog | none | ### Source From e90836ad43785c1528ae64221bb6c0a4968ffc03 Mon Sep 17 00:00:00 2001 From: "Mahir Chavda (C)" Date: Tue, 2 Jun 2020 16:54:00 +0530 Subject: [PATCH 3/4] Splunk Add-on for Symantec Endpoint Protection V3.1.0 will support Symantec EP syslog events --- docs/sources/Symantec/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/sources/Symantec/index.md b/docs/sources/Symantec/index.md index 45479b2..a7e7885 100644 --- a/docs/sources/Symantec/index.md +++ b/docs/sources/Symantec/index.md @@ -4,8 +4,8 @@ | Ref | Link | |----------------|---------------------------------------------------------------------------------------------------------| -| Splunk Add-on | No Public add-on | -| Product Manual | https://support.symantec.com/us/en/article.tech242216.html | +| Splunk Add-on | https://splunkbase.splunk.com/app/2772/ | +| Product Manual | https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/Monitoring-Reporting-and-Enforcing-Compliance/viewing-logs-v7522439-d37e464/exporting-data-to-a-syslog-server-v8442743-d15e1107.html | ### Sourcetypes From c1709e8eed2bf244976e444bd9e4e4f7f1b2a99c Mon Sep 17 00:00:00 2001 From: "Mahir Chavda (C)" Date: Tue, 2 Jun 2020 16:54:38 +0530 Subject: [PATCH 4/4] Update Symantec EP document & Fix formatting issue --- docs/sources/Symantec/index.md | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) diff --git a/docs/sources/Symantec/index.md b/docs/sources/Symantec/index.md index a7e7885..797ee62 100644 --- a/docs/sources/Symantec/index.md +++ b/docs/sources/Symantec/index.md @@ -37,18 +37,6 @@ MSG Parse: This filter parses message content -### Setup and Configuration - -* Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer. -* Review and update the splunk_index.csv file and set the index and sourcetype as required for the data source. -* Refer to the Splunk TA documentation for the specific customer format required for proxy configuration - * Select TCP or SSL transport option - * Ensure the format of the event is customized as follows - -``` -<111>1 $(date)T$(x-bluecoat-hour-utc):$(x-bluecoat-minute-utc):$(x-bluecoat-second-utc).000z $(x-bluecoat-appliance-name) bluecoat - splunk_format - c-ip=$(c-ip) Content-Type=$(quot)$(rs(Content-Type))$(quot) cs-auth-group=$(cs-auth-group) cs-bytes=$(cs-bytes) cs-categories=$(quot)$(cs-categories)$(quot) cs-host=$(cs-host) cs-ip=$(cs-ip) cs-method=$(cs-method) cs-uri-extension=$(cs-uri-extension) cs-uri-path=$(cs-uri-path) cs-uri-port=$(cs-uri-port) cs-uri-query=$(quot)$(cs-uri-query)$(quot) cs-uri-scheme=$(cs-uri-scheme) cs-User-Agent=$(quot)$(cs(User-Agent))$(quot) cs-username=$(cs-username) dnslookup-time=$(dnslookup-time) duration=$(duration) rs-status=$(rs-status) rs-version=$(rs-version) rs_Content_Type=$(rs-Content-Type) s-action=$(s-action) s-ip=$(s-ip) service.name=$(service.name) service.group=$(service.group) s-supplier-ip=$(s-supplier-ip) s-supplier-name=$(s-supplier-name) sc-bytes=$(sc-bytes) sc-filter-result=$(sc-filter-result) sc-filter-result=$(sc-filter-result) sc-status=$(sc-status) time-taken=$(time-taken) x-bluecoat-appliance-name=$(x-bluecoat-appliance-name) x-bluecoat-appliance-primary-address=$(x-bluecoat-appliance-primary-address) x-bluecoat-application-name=$(x-bluecoat-application-name) x-bluecoat-application-operation=$(x-bluecoat-application-operation) x-bluecoat-proxy-primary-address=$(x-bluecoat-proxy-primary-address) x-bluecoat-transaction-uuid=$(x-bluecoat-transaction-uuid) x-exception-id=$(x-exception-id) x-virus-id=$(x-virus-id) c-url=$(quot)$(url)$(quot) cs-Referer=$(quot)$(cs(Referer))$(quot) c-cpu=$(c-cpu) c-uri-pathquery=$(c-uri-pathquery) connect-time=$(connect-time) cs-auth-groups=$(cs-auth-groups) cs-headerlength=$(cs-headerlength) cs-threat-risk=$(cs-threat-risk) r-ip=$(r-ip) r-supplier-ip=$(r-supplier-ip) rs-time-taken=$(rs-time-taken) rs-server=$(rs(server)) s-connect-type=$(s-connect-type) s-icap-status=$(s-icap-status) s-sitename=$(s-sitename) s-source-port=$(s-source-port) s-supplier-country=$(s-supplier-country) sc-Content-Encoding=$(sc(Content-Encoding)) sr-Accept-Encoding=$(sr(Accept-Encoding)) x-auth-credential-type=$(x-auth-credential-type) x-cookie-date=$(x-cookie-date) x-cs-certificate-subject=$(x-cs-certificate-subject) x-cs-connection-negotiated-cipher=$(x-cs-connection-negotiated-cipher) x-cs-connection-negotiated-cipher-size=$(x-cs-connection-negotiated-cipher-size) x-cs-connection-negotiated-ssl-version=$(x-cs-connection-negotiated-ssl-version) x-cs-ocsp-error=$(x-cs-ocsp-error) x-cs-Referer-uri=$(x-cs(Referer)-uri) x-cs-Referer-uri-address=$(x-cs(Referer)-uri-address) x-cs-Referer-uri-extension=$(x-cs(Referer)-uri-extension) x-cs-Referer-uri-host=$(x-cs(Referer)-uri-host) x-cs-Referer-uri-hostname=$(x-cs(Referer)-uri-hostname) x-cs-Referer-uri-path=$(x-cs(Referer)-uri-path) x-cs-Referer-uri-pathquery=$(x-cs(Referer)-uri-pathquery) x-cs-Referer-uri-port=$(x-cs(Referer)-uri-port) x-cs-Referer-uri-query=$(x-cs(Referer)-uri-query) x-cs-Referer-uri-scheme=$(x-cs(Referer)-uri-scheme) x-cs-Referer-uri-stem=$(x-cs(Referer)-uri-stem) x-exception-category=$(x-exception-category) x-exception-category-review-message=$(x-exception-category-review-message) x-exception-company-name=$(x-exception-company-name) x-exception-contact=$(x-exception-contact) x-exception-details=$(x-exception-details) x-exception-header=$(x-exception-header) x-exception-help=$(x-exception-help) x-exception-last-error=$(x-exception-last-error) x-exception-reason=$(x-exception-reason) x-exception-sourcefile=$(x-exception-sourcefile) x-exception-sourceline=$(x-exception-sourceline) x-exception-summary=$(x-exception-summary) x-icap-error-code=$(x-icap-error-code) x-rs-certificate-hostname=$(x-rs-certificate-hostname) x-rs-certificate-hostname-category=$(x-rs-certificate-hostname-category) x-rs-certificate-observed-errors=$(x-rs-certificate-observed-errors) x-rs-certificate-subject=$(x-rs-certificate-subject) x-rs-certificate-validate-status=$(x-rs-certificate-validate-status) x-rs-connection-negotiated-cipher=$(x-rs-connection-negotiated-cipher) x-rs-connection-negotiated-cipher-size=$(x-rs-connection-negotiated-cipher-size) x-rs-connection-negotiated-ssl-version=$(x-rs-connection-negotiated-ssl-version) x-rs-ocsp-error=$(x-rs-ocsp-error) - -``` ### Options @@ -64,8 +52,8 @@ MSG Parse: This filter parses message content An active server will generate frequent events. Use the following search to validate events are present per source device ``` -index= sourcetype=symantec:ep:syslog | stats count by host -`` +index= sourcetype=symantec:ep:*:syslog | stats count by host +``` ## Product - ProxySG/ASG (Bluecoat) @@ -98,7 +86,12 @@ MSG Parse: This filter parses message content * Review and update the splunk_index.csv file and set the index and sourcetype as required for the data source. * Refer to the Splunk TA documentation for the specific customer format required for proxy configuration * Select TCP or SSL transport option - * Ensure the format of the event is customized per Splunk documentation + * Ensure the format of the event is customized as follows + +``` +<111>1 $(date)T$(x-bluecoat-hour-utc):$(x-bluecoat-minute-utc):$(x-bluecoat-second-utc).000z $(x-bluecoat-appliance-name) bluecoat - splunk_format - c-ip=$(c-ip) Content-Type=$(quot)$(rs(Content-Type))$(quot) cs-auth-group=$(cs-auth-group) cs-bytes=$(cs-bytes) cs-categories=$(quot)$(cs-categories)$(quot) cs-host=$(cs-host) cs-ip=$(cs-ip) cs-method=$(cs-method) cs-uri-extension=$(cs-uri-extension) cs-uri-path=$(cs-uri-path) cs-uri-port=$(cs-uri-port) cs-uri-query=$(quot)$(cs-uri-query)$(quot) cs-uri-scheme=$(cs-uri-scheme) cs-User-Agent=$(quot)$(cs(User-Agent))$(quot) cs-username=$(cs-username) dnslookup-time=$(dnslookup-time) duration=$(duration) rs-status=$(rs-status) rs-version=$(rs-version) rs_Content_Type=$(rs-Content-Type) s-action=$(s-action) s-ip=$(s-ip) service.name=$(service.name) service.group=$(service.group) s-supplier-ip=$(s-supplier-ip) s-supplier-name=$(s-supplier-name) sc-bytes=$(sc-bytes) sc-filter-result=$(sc-filter-result) sc-filter-result=$(sc-filter-result) sc-status=$(sc-status) time-taken=$(time-taken) x-bluecoat-appliance-name=$(x-bluecoat-appliance-name) x-bluecoat-appliance-primary-address=$(x-bluecoat-appliance-primary-address) x-bluecoat-application-name=$(x-bluecoat-application-name) x-bluecoat-application-operation=$(x-bluecoat-application-operation) x-bluecoat-proxy-primary-address=$(x-bluecoat-proxy-primary-address) x-bluecoat-transaction-uuid=$(x-bluecoat-transaction-uuid) x-exception-id=$(x-exception-id) x-virus-id=$(x-virus-id) c-url=$(quot)$(url)$(quot) cs-Referer=$(quot)$(cs(Referer))$(quot) c-cpu=$(c-cpu) c-uri-pathquery=$(c-uri-pathquery) connect-time=$(connect-time) cs-auth-groups=$(cs-auth-groups) cs-headerlength=$(cs-headerlength) cs-threat-risk=$(cs-threat-risk) r-ip=$(r-ip) r-supplier-ip=$(r-supplier-ip) rs-time-taken=$(rs-time-taken) rs-server=$(rs(server)) s-connect-type=$(s-connect-type) s-icap-status=$(s-icap-status) s-sitename=$(s-sitename) s-source-port=$(s-source-port) s-supplier-country=$(s-supplier-country) sc-Content-Encoding=$(sc(Content-Encoding)) sr-Accept-Encoding=$(sr(Accept-Encoding)) x-auth-credential-type=$(x-auth-credential-type) x-cookie-date=$(x-cookie-date) x-cs-certificate-subject=$(x-cs-certificate-subject) x-cs-connection-negotiated-cipher=$(x-cs-connection-negotiated-cipher) x-cs-connection-negotiated-cipher-size=$(x-cs-connection-negotiated-cipher-size) x-cs-connection-negotiated-ssl-version=$(x-cs-connection-negotiated-ssl-version) x-cs-ocsp-error=$(x-cs-ocsp-error) x-cs-Referer-uri=$(x-cs(Referer)-uri) x-cs-Referer-uri-address=$(x-cs(Referer)-uri-address) x-cs-Referer-uri-extension=$(x-cs(Referer)-uri-extension) x-cs-Referer-uri-host=$(x-cs(Referer)-uri-host) x-cs-Referer-uri-hostname=$(x-cs(Referer)-uri-hostname) x-cs-Referer-uri-path=$(x-cs(Referer)-uri-path) x-cs-Referer-uri-pathquery=$(x-cs(Referer)-uri-pathquery) x-cs-Referer-uri-port=$(x-cs(Referer)-uri-port) x-cs-Referer-uri-query=$(x-cs(Referer)-uri-query) x-cs-Referer-uri-scheme=$(x-cs(Referer)-uri-scheme) x-cs-Referer-uri-stem=$(x-cs(Referer)-uri-stem) x-exception-category=$(x-exception-category) x-exception-category-review-message=$(x-exception-category-review-message) x-exception-company-name=$(x-exception-company-name) x-exception-contact=$(x-exception-contact) x-exception-details=$(x-exception-details) x-exception-header=$(x-exception-header) x-exception-help=$(x-exception-help) x-exception-last-error=$(x-exception-last-error) x-exception-reason=$(x-exception-reason) x-exception-sourcefile=$(x-exception-sourcefile) x-exception-sourceline=$(x-exception-sourceline) x-exception-summary=$(x-exception-summary) x-icap-error-code=$(x-icap-error-code) x-rs-certificate-hostname=$(x-rs-certificate-hostname) x-rs-certificate-hostname-category=$(x-rs-certificate-hostname-category) x-rs-certificate-observed-errors=$(x-rs-certificate-observed-errors) x-rs-certificate-subject=$(x-rs-certificate-subject) x-rs-certificate-validate-status=$(x-rs-certificate-validate-status) x-rs-connection-negotiated-cipher=$(x-rs-connection-negotiated-cipher) x-rs-connection-negotiated-cipher-size=$(x-rs-connection-negotiated-cipher-size) x-rs-connection-negotiated-ssl-version=$(x-rs-connection-negotiated-ssl-version) x-rs-ocsp-error=$(x-rs-ocsp-error) + +``` ### Options