2. D3 Cyber Incident Response Integration for Splunk

Size: px

Start display at page:

Download "2. D3 Cyber Incident Response Integration for Splunk"

Chad Page
6 years ago
Views:

1 Table of Contents 1. Description D3 Add-on and App D3 Cyber Add-on D3 Cyber App D3 Cyber Incident Response Integration for Splunk D3 Cyber App for Splunk Installation and Configuration for D3 Add-on and App Requirements Installation Configuration Splunk to D3 Cyber Add Event to D3 Cyber IRP View IR/Case List in D3 Cyber D3 Cyber App Dashboard Support... 6

2 1. Description D3 Add-on and App 1.1 D3 Cyber Add-on The combination of Splunk Enterprise Security and the D3 Cyber Incident Response Platform enables incident responders to quickly and efficiently go from detection and analysis to remediation and post incident learning. With the D3 Cyber Incident Response Integration for Splunk relevant information can move between the two platforms effortlessly. The centralized workflow environment means faster remediation and consistent logging of steps. 1.2 D3 Cyber App The D3 Cyber App for Splunk provides advanced functionality for Splunk Enterprise Security in combination with the D3 Cyber Incident Response Platform. The D3 Cyber app brings relevant information into Splunk via a preconfigured dashboard along with the ability to investigate incidents with details provided by the D3 Cyber IR Platform. 2. D3 Cyber Incident Response Integration for Splunk The D3 Cyber Incident Response application Add-on facilitates the communication of events data between Splunk and the D3 Cyber Incident Response Platform. Features include: Pulling threat event data from Splunk into the D3 Cyber application via pre-configured action items Viewing and Opening an Incident or Case via pre-configured action item Drill down into individual incidents to view further details from D3 Cyber IR Platform Reading all the relevant indicators with a threat type and transfers these indicators into the D3 Cyber IR Platform for entity profiling. Supporting both factory shipped and custom configured correlated search types in Splunk. Communicating the data points such as incident number, status, processing state etc. of incidents in D3 Cyber IR Platform back to Splunk. Allowing users to correlate the D3 Cyber incidents to the original Splunk events. 3. D3 Cyber App for Splunk The D3 application dashboard for Splunk provides an overview of the Incidents & Cases managed in the D3 Incident Response Platform initially created from Splunk Notable Events. Important features include: View D3 Cyber Incident details such as Incident number, type, title, etc. within the Splunk application

3 View status of associated D3 Cyber Incidents from Splunk events See the trend reporting on Splunk Notable Events and D3 Cyber Incidents & Cases within the Splunk application Able to record evolving timeline of Events, Incidents and Cases through a real time dashboard 4. Installation and Configuration for D3 Add-on and App 4.1 Requirements System requirements include: Splunk version 6.4 or later Splunk Enterprise Security D3 Cyber Incident Response Platform version 9 or higher The D3 Cyber IR Add-on is optimized for Google Chrome and Internet Explorer other browser may work but are currently not supported D3 Cyber App for Splunk requires the D3 Cyber Add-on for Splunk 4.2 Installation D3 Cyber Add-on: Download the D3 Cyber IR Add-on from Splunkbase and follow the installation instructions given on the download page. Once setup the Add-on will run in the background and can be accessed via the Manage App gear on the Splunk home page. D3 Cyber App: From within Splunk, click the Find More Apps graphic then search for D3 and choose the D3 Cyber Incident Response Dashboard for Splunk app. Click the install button which will automatically install the app. The D3 Cyber app comes pre-configured with the All in One dashboard which has number of reports such as D3 incidents created in the past 24 hours and Most Active D3 Incidents. Further reports can be added by advanced users through Settings > User interface > Views > all_in_one. No further configuration is needed 4.3 Configuration D3 Cyber Add-on: You will be asked for the following items to complete the configuration: Time zone of your D3 source D3 host URL D3 username and password

4 This will complete your installation and setup. See the Support section for contact information and feel free to reach out to us for further assistance with the Add-on installation. 5. Splunk to D3 Cyber 5.1 Add Event to D3 Cyber IRP Once the D3 Cyber IR Add-on is configured, SOC analysts have the ability to push Notable events into the D3 platform via the Actions drop down menu. All relevant information from Splunk Enterprise Security will be transferred to the D3 Cyber IRP where a new incident report will be created.

From the list view, analysts are able to click into these incident reports and cases for expedited information gathering.

5 5.2 View IR/Case List in D3 Cyber A second option within the Actions drop down is the ability to view incident reports and cases that have been pushed from Splunk to D3 Cyber. From the list view, analysts are able to click into these incident reports and cases for expedited information gathering. 6. D3 Cyber App Dashboard The D3 Cyber app provides an interactive dashboard which allows the analyst to drill down into the incident and into the correlated search tied to that incident.

With the two way integration between the D3 Cyber IR Platform and Splunk, analysts have instant access to real time incident report and case status on the dashboard.

6 With the two way integration between the D3 Cyber IR Platform and Splunk, analysts have instant access to real time incident report and case status on the dashboard. Trending can be recorded and exported through this area as well. 7. Support For further information or trouble shooting please contact D3 Cyber support at: Phone: (Ext. 1)

The Resilient Incident Response Platform

The Resilient Incident Response Platform Accelerate Your Response with the Industry s Most Advanced, Battle-Tested Platform for Incident Response Orchestration The Resilient Incident Response Platform