User Guide: TruSTAR Unified App for Splunk Enterprise & Enterprise Security

Updated 1 week ago by TruSTAR

This document explains how to use the TruSTAR Unified Workflow App for Enterprise & Enterprise Security (ES).

Features

Depending on which version of Splunk you are using, different features are available.

Splunk Enterprise

If you have Splunk Enterprise, you can use the TruSTAR Splunk APP for Enterprise & Enterprise Security to:

  • Load Indicators from TruSTAR. Collect Indicators from TruSTAR Enclaves and load them into the Splunk KV Store to alert against internal log events. See the Configuring Inputs section of the Install KB article for instructions on how to set up these inputs.

Splunk ES

Splunk ES users can use the TruSTAR Splunk APP for Enterprise & Enterprise Security to load indicators (as above) and also to work with Notable Events:

  • Manually Enrich a Notable Event in Splunk ES. This process uses the Threat Match value in the Notable Event to search one or more TruSTAR Enclaves for more information about that value and adds any new information to the Event.
  • Manually submit a Notable Event to TruSTAR. This creates an Intelligence Report in the TruSTAR Enclave you specified when configuring the App. You can use that Enclave to set up workflows within TruSTAR or to configure inputs in Splunk ES that filter the enriched data back into KV stores.
  • Manually Enriching a Notable Event

This feature is only available with Splunk ES.

You can enrich a Notable Event using intel from the TruSTAR Enclaves specified in the TruSTAR App configuration.

  1. Create an ad-hoc search by specifying values in Status, Owner or other fields displayed on the screen. In the example screen below, the only parameter selected was "Last 90 Days" in the Time field. The Incident Review search returned the list of results you see at the bottom of the screen.
    SplunkES_UserGuide_Figure1
  2. Click the Actions carat on the far right of any event to display the Actions menu.
    SplunkES_UserGuide_Figure2
  3. Choose Run Adaptive Response Actions from that menu. This displays a dialog box of possible actions.
    SplunkES_UserGuide_Figure3
  4. Click the TruSTAR - Enrichment option. (Note: You may need to scroll down to display this option.) This displays the dialog box where you can configure the enrichment action.
    SplunkES_UserGuide_Figure4
  5. Select the Enclave(s) to use for the enrichment:
  • Default Enrichment: Queries the Enclaves you configured in the TruSTAR App as enrichment enclaves.
  • Custom Enrichment: Queries a specified list of one or more TruSTAR Enclaves, or ALL Enclaves. To specify a list of Enclaves, provide a list of Enclave IDs, separated by commas.
  1. Adjust the Urgency setting. This allows the enrichment to adjust the urgency of the Notable Event based on information from the enrichment. TruSTAR recommends leaving this setting Enabled.
  2. Click Run to start the enrichment action. The dialog box displayed below provides confirmation that the enrichment action is being executed.
    SplunkES_UserGuide_Figure5
  3. Click X in the upper right corner to close this message box and return to the list of Notable Events.
  4. To view the results of the enrichment, expand the Notable Event by clicking the carat on the far left of it. This displays the details of the event. In the example screen below, you can see that the TruSTAR - Enrichment action displays Success as status, meaning the action has completed.
SplunkES_UserGuide_Figure6
  1. Click the TruSTAR - Enrichment link to see details of what the enrichment action has returned. Based on enrichment from TruSTAR, the Urgency indicator for the Notable Event may be raised or lowered.
Details
This enrichment action checks only the Enclaves specified in the Configuration section of the TruSTAR App. It displays the information those Enclaves have at the time of the action; to receive additional enrichment, rerun this action.

TruSTAR will only raise the severity of an Event; it will never lower the severity; For example, if an event has a Critical severity score and TruSTAR rates it as High, the Urgent rating will remain unchanged.

Manually Submitting a Notable Event

You can manually submit a Notable Event to TrUSTAR. If you want to automatically submit then, see the Automatic Submission section of the Install article.

  1. Click the Actions carat at the far right of a Notable Event to display the Actions menu.
  2. Click Run Adaptive Response Actions from that menu. This displays a dialog box of possible actions.
    SplunkES_UserGuide_Figure8
  3. Click the TruSTAR - Submit option. This displays the dialog box where you can configure the reporting action.
    SplunkES_UserGuide_Figure9
  4. Select the settings you want to use:
  • Report Title: This will be the report title displayed in TruSTAR.
  • Additional Comments: Use this field as notes on the event that you or your team may find useful.
  • Custom or Default: This selects whether or not to use the default submission Enclave specified in the TruSTAR App configuration setting.
  • Custom Enclave ID: If you choose Custom Enclave, use this field to specify the GUID of the Enclave you want to use for this Intel Report.
  • Redact: Chooses whether or not to redact information specified in your TruSTAR Redaction Library. By default, redaction is disabled.
  1. Click Run to submit the Intel Report. A popup window provides confirmation that the report has been submitted.

Viewing Submission Status

To view the status of the report submittal, expand the Notable Event by clicking the carat on the far left of it. In the example screen below, you can see that the TruSTAR - Report action displays Success as status, meaning the report has been submitted.

Viewing the TruSTAR Report

To view the report itself, you can log in to the TruSTAR Web App. When TruSTAR receives the Intel Report, it queries all specified Enclaves for enrichment. This process can take a while to complete.

Research an Observable in TruSTAR.

This app includes a workflow action that enables the user to jump to an observable's graph view in TruSTAR.

More info about Splunk workflow actions:

- About Workflow Actions in SplunkWeb
Using the workflow action.

While viewing a log event:

  1. click the drop-down Actions carat to the right of the observable you'd like to research.
  2. click the Resarch in TruSTAR: _____[observable value]___ action in the drop-down menu.


How Did We Do?