<Partner Name> RSA ARCHER GRC Platform Implementation Guide. Gurucul Risk Analytics. <Partner Product>

Transcription

1 <Partner Name> <Partner Product> RSA ARCHER GRC Platform Implementation Guide Jeffrey Carlson, RSA Partner Engineering Last Modified: August 1 st, 2017

2 Solution Summary Gurucul is changing the way enterprises protect themselves against fraud, insider threats and external intruders on premise and in the cloud. The company s user behavior analytics and identity access intelligence technology uses machine learning and predictive anomaly detection algorithms to reduce the attack surface for accounts, unnecessary access rights and privileges, and identify, predict and prevent breaches. Gurucul provides Hybrid Behavior Analytics (HBA) architecture with the breadth of Identity Access Intelligence to User Behavior Analytics, and the depth from cloud apps to on-premises behavior. Gurucul technology is used globally by organizations to detect insider fraud, IP theft, external attacks and more. By integrating GRA and RSA Archer, organizations can monitor, manage, and remediate security incidents related to anomalous user behavior. Partner Integration Overview GRC Use Case Uses Out of The Box Solution Uses Custom Application Requires On-Demand License IT Security Risk Management/Security Operations Management Security Incident Management Yes (GRA Anomalies) Yes, 1 ODA

3 RSA Archer GRC Configuration Installing the GRA Anomalies Application Package Before configuring the GRA Data Feed, you must first install the GRA Anomalies application package (GRA_Application.zip). This is an on-demand application that has a child relationship to the out of the box Security Incidents application. To install the application package, perform the following steps: 1. On the RSA Archer Server, go to Administration -> Application Builder -> Install Packages: 2. Click Import and browse to the package import file (GRA_Application.zip). Click OK. 3. Click the Install button to install the package 4. The process should complete without any errors

4 Configuring the Security Incidents Application Once the application package has been installed, it will add a cross-reference to the Security Incidents application. This will allow you to see GRA anomaly records from a given Security Incident. It is also necessary to create a custom field to store the GRA Case ID and create new Security Incident records from GRA. To do this, perform the following steps: 1. On the RSA Archer server, browse to Administration -> Application Builder -> Security Incidents. 2. Click the Fields tab, then select Add New. 3. Select the Create a new field from scratch radio button, and set the Field Type as Text. 4. Name the field GRA Case ID, and click Save. 5. Next, add the field to the layout by selecting the Layout tab. 6. Drag the GRA Case ID field to the layout in the position you desire. 7. Drag the GRA Anomaly Cross Reference to the layout in the position you desire:

5 Now that the application is installed and the layout is configured, you can move on to setting up the Data Feed from GRA to create the actual Security Incident records and their associated GRA Anomalies. Installing the GRA Data Feed Gurucul GRA Security Incidents (GRA Cases) are created in Archer via a preconfigured Data Feed. This Data Feed loads the case information from an XML file that is pushed to the RSA Archer server via FTP (consult this section of the document for more information on the steps to do this). To configure the Data Feed, perform the following steps: 1. On your RSA Archer Server, browse to Administration -> Integration -> Data Feeds: 2. Select Import and browse to the GRA Data Feed file (GraDataFeed.dfx5). 3. Review the Data Feed configuration on the General Tab. Ensure that the Target is Security Incidents

6 4. Review the settings on the Transport tab. Leave the Transport Method as File Transporter, but make any necessary changes to the Path as required: 5. Review the settings on the Data Map tab. The DFX file contains the recommended mappings which can also be found in Appendix A: 6. Under the Data Map Key Field Definitions tab, ensure that the Key Fields are set as follows: Security Incidents GRA Case ID

7 GRA Anomaly Anomaly Reference Review the settings on the Update/Archive tab and make any necessary changes. 7. Set a Schedule for the feed by clicking the Schedule tab: 8. Make any necessary changes to the schedule or click the Start button to run the feed immediately

8 Partner Product Configuration Before You Begin This section provides instructions for configuring (GRA) with the RSA Archer GRC Platform. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products in order to install the required components. All Gurucul components must be installed and working prior to the integration. Perform the necessary tests to confirm that this is true before proceeding. Important: The integration described in this guide is being provided as a reference implementation for evaluation and testing purposes. It may or may not meet the needs and use cases for your organization. If additional customizations or enhancements are needed, it is recommended that customers contact RSA Professional Services for assistance. Creating a Data Source in (GRA) Please note that in order to deliver the GRA Anomalies feed file to the RSA Archer server, FTP must be enabled on the Archer system. This can be done via the built-in Windows FTP server, or via another third-party FTP server. The instructions for doing so are outside the scope of this document. 1. Login to GRA Open a browser of your choice and type the following web address to launch the web interface: This opens the login page of GRA

9 2. Navigate to Configuration > Data > Setup > Data Source 3. Click on the +Add button on the top right corner of the screen 4. Provide the Data Source details as described below Connection Name: Suitable Name Select Datasource Type as: FTP Host: <Archer Server IP>

10 Port: 21 User name: Password: <FTP Username> <FTP Password> Remote Directory: /Program Files/RSA Archer/DataFeed/grafeeds/ (this is the default -- must match config in.dfx file) Transport Protocol: FTP 5. After providing the details as described, click the Test Connection button. The connection status should be Successful as shown above

11 Sending GRA Cases to RSA Archer To configure the Forwarder Job to send GRA Cases to RSA Archer, perform the following steps: 1. Navigate to Sidebar > Configure > Data > Data Forwarders Workflow > Forwarder Job (top right corner): 2. Set the Details as follows: Destination Type: Destination: Configuration Name: FTP <Connection Name> (as configured in previous section) RSAArcher-XML 3. Click Next: 4. Select the Data that you want to forward. 5. Click Next:

12 6. Confirm the Data and click Next: 7. Provide a suitable Job Title and Description. Next, click Start: 8. The job Status should display SUCCESS. 9. The Data Feed Import File is created on the Archer server (C:\Program Files\RSA Archer\DataFeed\grafeeds by default). Now that the Job Forwarder is setup to forward the data to the Archer server, the next step is to install the GRA Anomalies application package and configure the GRA Data Feed. Note: GRA Cases can be forwarded to RSA Archer using Data Forwarder also

13 Retrieving GRA Cases from RSA Archer Gurucul GRA can pull updated incidents from RSA Archer using the Archer Web Services API. This is done via a report called GRAStatusReport that is part of the application package. To see this report, perform the following steps in Archer: 1. Click on Administration -> Manage Applications -> Management Reporting > Master Reports Listing. 2. Filter reports starting with GRA and click on GRAStatusReport: 3. Below is an incident list visible in GRAStatusReport: 4. This report can be imported into GRA to capture any changes made in Archer

14 Create the RSA Archer Data Source To configure a GRA Data Source to retrieve updated incident info from RSA Archer, perform the following steps: 1. Login to GRA Open a browser of your choice and type the following web address to launch the web interface: This opens the login page of GRA. 2. Navigate to Configuration > Data > Setup > Data Source 3. Click on the +Add button on the top right corner of the screen

15 4. Set the Details as follows: Connection Name: Select Datasource Type as: Host Name: User name: <Suitable Name> RsaArcher <Archer Server IP> <API User Account> Password: ********* Instance Name: Transport Protocol: <Instance Name> HTTP 5. After providing the details as described, click the Test Connection button. The connection status should be Successful as shown above

16 Running the Job to Retrieve Cases from RSA Archer In order to create the job that will retrieve case updates from RSA Archer, perform the following steps: 1. In the GRA Admin UI, navigate to Sidebar > Configure > Data > Data Import > Case > +Add (top right corner) 2. Select the Import Type as RsaArcher. and the Connection Type as RSA_Archer. Click Next. 3. Review the Archer Template and click Save:

17 4. Provide a suitable Job Title and Description: 5. Click Start. The Job Status should display SUCCESS as in the example above. 6. When a Job is complete, the data can be seen under Respond ->Cases ->Imported Cases in the GRA

18 Certification Environment for RSA Archer GRC Date Tested: July 17 th, 2017 Certification Environment Product Name Version Information Operating System RSA Archer GRC 6.2 Virtual Appliance 6.2 CentOS

19 Appendix A Gurucul GRA Data Feed Configuration GRA Source Field Case_Owner DateTime_Closed DateTime_Modified gra_case_id Incident_Details Incident_Status Incident_Summary Priority Source Title Security Incidents Archer Target Field Case Owner Date/Time Closed Date/Time Modified GRA_Case_ID* Incident Details Incident Status Incident Summary Priority Source Title account_name activity_count anomaly_name anomaly_reference anomaly_status resource_name GRA Anomaly Account Name Activity Count Anomaly Name Anomaly Reference* Status Resource Name * Denotes that this is a Key Field to uniquely identify a record