Luna HSM App for Splunk

Welcome to Luna HSM App; the application that monitors Luna HSM appliances using syslog and SNMP poll requests, thereby enabling users to monitor the appliance's health status and availability. Users can get analytics on any Luna HSM appliance that is configured with the Luna HSM App.

The following section details the prerequisites, and instructions on Luna HSM App download and deployment.

Installation Prerequisites

The following section lists the installation requirements for Luna HSM App:

1. Download and install Splunk Enterprise Server. Luna HSM App is currently supported on the Splunk Enterprise over Linux RHEL 6.x and Cent OS platform.
2. Ensure that the hostname of the Luna HSM appliances are different as they are used to differentiate between the appliance and their captured logs.
3. Splunk SNMP modular input version 1.7.8 or above must be deployed on Splunk server.
   • Visit This Page to deploy Splunk SNMP Modular Input. You could also download it from the link here.
   • Perform the Splunk SNMP modular input setting configuration (refer deployment document of Splunk SNMP modular input plugin). Refer to the link here for its documentation and perform those steps carefully.

4. Syslog and SNMP poll/trap must be configured on the Luna HSM Appliance.

   • To configure syslog on splunk server, run the command below on your Luna HSM appliance.

     syslog re add -h < Splunk_server_IP > -pr tcp -po 7171

     Note: Update < Splunk_server_IP > as the IP of your splunk machine.

   • To configure and enable SNMP traps/poll on Luna appliance, run the following set of steps. Each step corresponds to an administrative command via the Luna shell.

     • Add an SNMP user to the system using the command:
       sysconf snmp user add -s < Security_Username > -authPassword < PASSWORD > -authProtocol < Auth_protocol > -privPassword < PASSWORD > -privProtocol < Priviledge_protocol >
     • Enable SNMP using the command sysconf snmp enable.
     • Set the SNMP trap parameters for the user created in the preceding step using command sysconf snmp trap set.
     • Enable SNMP traps using command sysconf snmp trap enable

Assuming that you use Pete as the snmp user, here are the list of commands that you can copy-and-paste directly into a Lush session to configure and enable traps. Ensure that the IP address for sysconf snmp trap set matches the target < Splunk_server > for SNMP notifications. The examples in the application use 192.168.0.100.

1. Add an SNMP user to the system using the command:
   sysconf snmp user add -s pete -authPa 87654321 -authPr SHA -privPa 12345678 -privPr AES
2. Enable SNMP using the command sysconf snmp enable
3. Set the SNMP trap parameters for the user created in the previous step:
   sysconf snmp trap set -h 192.168.0.100 -s pete -e 1234567890 -authpr SHA -authpw 87654321 -privPr AES -privPwd 12345678
4. Enable SNMP traps using the command sysconf snmp trap enable

Post-Installation Requirements

Please make sure to configure the following settings on the Splunk web interface after you have downloaded and installed the Luna HSM App.

1. Ensure to assign the can_delete role to the Splunk Admin User. This can be assigned on the splunk web interface in the Settings section under Access controls » Users.
2. Make sure that you configure the Email settings to send alerts on sensitive operations to users. You can configure the same in the Settings section under Server settings » Email settings on the splunk web interface.

Luna HSM App - Download and Installation

This section details the instructions on downloading the Luna HSM App.

1. Download the Luna HSM App application from the package provided at The Splunk App Page.

   

2. Click the Download button available on the page.

3. The luna-hsm-app-for-splunk_xxx.tgz file gets downloaded, after the license agreements are accepted.

   

4. Login to the Splunk web interface, click on App -> Manage Apps to open the Apps Management page in Manager.

5. Click the Install app from file button, locate the downloaded file (luna-hsm-app-for-splunk_xxx.tgz file) and click Upload.
6. Restart the splunk server after the file upload. The application is deployed.
7. Verify (if necessary) that the application is installed. It should be listed in the list of apps installed within the Manager and can be found on the server at
   **https://splunkbase.splunk.com/app/2771/**

Verification

The following points can be used to verify that the Luna HSM App application is installed properly.

• A new application named Luna HSM App should be listed in the list of applications installed within the Manager.
• New index named lunasa_appliance, hsm_operation, hsm_client_addr, hsm_partition_info and luna_syslog1 should have been created in the index list section.
• New Fields extraction should be displayed in Splunk Setting->Fields->Fields extraction section for Luna HSM App.
• New Alerts must be displayed in Setting-> search,reports and Alert section for Luna HSM App.
• A TCP input type must be displayed in Setting->Data Inputs->TCP section. The TCP port should be 7171.

Online Demonstration

Click here to watch a video that demonstrates the installation steps to use Luna HSM App.

Adding Custom MIBs to Splunk Modular Input:

Before you begin to add custom MIBs to Splunk Modular Input, make sure that you have deployed the PyCrypto package. Refer to the section, “Building and Installing PyCrypto” available in SNMP Modular Input documentation at https://splunkbase.splunk.com/app/1537/#/documentation

For Luna HSM App, we require following custom MIBs in python(.py) format:

• SAFENET-HSM-MIB
• LM-SENSORS-MIB
• CHRYSALIS-UTSP-MIB
• SAFENET-APPLIANCE-MIB
• SAFENET-GLOBAL-MIB
• SNMPv2-SMI

Note: Thales provides these custom MIBs files in python (.py) as well as in the .txt format with this application.

• You could either use the custom MIB python files (converted using Python 3.6.8 on our Linux (CentOS 7) system). Copy them from the location $SPLUNK_HOME$/etc/apps/deviceinformation/bin and paste them at $SPLUNK_HOME/etc/apps/snmp_ta/bin/mibs, or
• Regenerate python files out of the custom MIB txt files using the build-pysnmp-mib method available with Splunk Modular Input (click the link here to refer to the process as defined under the section Adding Custom MIBs in Splunk Modular Input documentation).

More Information

For more information on how to use the Luna HSM App, refer to the Luna HSM App Installation and User Guide, available in the installed package under the \deviceinformation\static folder.