Skip to main content
Lantern Home

 

Splunk Lantern

Implementing real-time cloud application threat detection with Secure Application and Enterprise Security

  1. Last updated
  2. Save as PDF

You are a SecOps team member trying to establish an end-to-end security workflow for your organization's cloud applications, allowing you to effectively detect, investigate, and respond to application attacks, including zero-day threats. You're finding that disparate security tools and manual processes are hindering rapid detection and automated response, so you're looking for a unified integration that helps you streamline event collection, enhance threat detection, and automate response actions.

How to use Splunk software for this use case

This article covers how to set up Splunk Observability Cloud, Secure Application, and Splunk Enterprise Security (ES) to work together, providing an end-to-end unified workflow to detect and investigate application attacks, including zero day attacks.

You'll follow a number of steps to do this:

  1. Configure a source type in Splunk Enterprise Security.
  2. Configure Splunk Enterprise Security to receive events.
  3. Configure Secure Application to send events.
  4. Configure Splunk Enterprise Security detection.

1. Configure a source type in Splunk Enterprise Security

Follow the steps outlined in create source types to add two new source types for Secure Application data.

The first source type will have a name of secureapp_attack with the following settings:

TRUNCATE=0
KV_MODE=JSON
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%6Q %z
TIME_PREFIX=lastDetected":\s+"

The second source type will have a name of secureapp_vulnerability with the following settings:

TRUNCATE=0
KV_MODE=JSON
DATETIME_CONFIG = CURRENT

2. Configure Splunk Enterprise Security to receive HTTP event data

Follow the appropriate Collect HTTP event data instructions for your deployment to configure Splunk Enterprise Security to receive HTTP event data. You will need to generate a HEC token for both data types, attacks and vulnerabilities. You will use the source types created in the prior step when creating each HEC token.

During this process you'll generate two HEC tokens. Make a note of these, as you'll need to refer to them later.

3. Configure Observability Cloud Secure Application to send events to Splunk Enterprise Security

Follow the Set up notifications for vulnerabilities instructions to configure Secure Application to send data to Splunk Enterprise Security.

You will set up a vulnerability alert and an attack alert during this process. Make sure you configure these with the following information:

Vulnerability alert

  • In step 2, select Vulnerability for the Event Type.
  • In step 2 for URL, use the raw HEC endpoint. The URL you enter should end in /services/collector/raw.
  • In step 2, the Bearer token is the HEC token details you generated in step 1 using the secureapp_vulnerabilites source type. Ensure the token is predicated with 'Splunk'. For example, Splunk <HEC TOKEN>.

Attack alert

  • In step 2, select Attack for the Event Type.
  • In step 2 for URL, use the raw HEC endpoint. The URL you enter should end in /services/collector/raw.
  • In step 2, the Bearer token is the HEC token details you generated in step 1 using the secureapp_attack source type. Ensure the token is predicated with 'Splunk'. For example, Splunk <HEC TOKEN>.

Secure Application should now be configured to send all new vulnerabilities and attacks that are detected.

4. Configure Splunk Enterprise Security detection

The detection you'll be configuring includes pre-defined drilldowns and searches to help with an investigation.

  1. Install Splunk ES Content Update (ESCU) and ensure it is updated to the latest version.
  2. In Splunk Enterprise Security, go to Content Management and search for the Splunk Secure Application Alerts for Runtime Security detection.
  3. While you can turn this detection on as-is, you might want to review the detection to ensure it is aligned to your team's practices. When you're happy, turn on the detection. This will generate a new finding for each new, unblocked attack that is detected.

After everything is configured, and after a period of time has passed, you should start to see findings populate to the ES Analyst Queue. You can start to triage these findings and open a deeper investigation if needed. If after several hours there are no findings that are generated and you are seeing attacks in Splunk Observability Cloud, you will need to troubleshoot those missing findings.

Additional resources

These resources might help you understand and implement this guidance: