Bricata Add-on for Splunk
Overview
Details
This Add-on makes use of Bricata's RAW export option which transmits a continuous stream of JSON documents containing alerts and network metadata events over a TCP socket. To receive this event stream, on a Splunk Forwarder, the TA configures two of Splunk's raw TCP inputs which listen on the following ports:
- 4567
- 4568 (for SSL)
The inputs.conf file included does not define a default index for the input nor does the Add-on create any indices. If you prefer to have Bricata data routed to a specific index you may create a local copy of the inputs.conf file and customize the input's index routing to your liking.
Bricata's Splunk knowledge objects are bound to the sourcetype defined by the input, bricata:raw, so changes to index routing should have no affect on them. Leveraging the power of Splunk's search-time JSON field extractions, the TA provides the following additional enrichments.
- Field Aliases
- Eventtypes
- Tags
Installation
The TA can be installed by extracting the archive into the /opt/splunk/etc/apps directory and restarting Splunk. Alternatively it can be installed through the Splunk UI.
If running a distributed Splunk deployment, The TA should be installed on Splunk Forwarders that will receive the network inputs. It should also be installed on the Search Head(s) that will be used for search and analysis, including those running any CIM-dependent apps that leverage network transaction and IDS alert data.
Release Notes
Version 3.0.1
The Bricata Technology Add-on for Splunk enables the streaming of Bricata-generated high-fidelity network metadata directly to Splunk Enterprise. The Bricata TA defines a series of knowledge objects to conform Bricata’s data to Splunk’s Common Information Model. The TA ensures Bricata data is seamlessly accepted into Splunk, that it can be fluidly searched in isolation and in combination with other Splunk-aggregated data, and that continued interoperability is maintained with existing Enterprise Apps.
Release 3.0.1
Implemented Splunk best practices for TA file permissions (no change to content)
Release 3.0
See 'README.md' for detailed installation instructions and features
This release:
Improved CIM 4.0 mappings
Added syslog server and/or 'syslog' data streaming to tcp listeners. This feature enables users to select which fields are supplied to Splunk vs. the 'all or nothing' approach used in JSON event streaming.
The add-on provides CIM compatible field extractions to normalize the data.
Version 3.0.0
The Bricata Technology Add-on for Splunk enables the streaming of Bricata-generated high-fidelity network metadata directly to Splunk Enterprise. The Bricata TA defines a series of knowledge objects to conform Bricata’s data to Splunk’s Common Information Model. The TA ensures Bricata data is seamlessly accepted into Splunk, that it can be fluidly searched in isolation and in combination with other Splunk-aggregated data, and that continued interoperability is maintained with existing Enterprise Apps.
Release 3.0
See 'README.md' for detailed installation instructions and features
This release:
Improved CIM 4.0 mappings
Added syslog server and/or 'syslog' data streaming to tcp listeners. This feature enables users to select which fields are supplied to Splunk vs. the 'all or nothing' approach used in JSON event streaming.
The add-on provides CIM compatible field extractions to normalize the data.
Version 2.1.0
The Bricata Technology Add-on for Splunk enables the streaming of Bricata-generated high-fidelity network metadata directly to Splunk Enterprise. The Bricata TA defines a series of knowledge objects to conform Bricata’s data to Splunk’s Common Information Model. The TA ensures Bricata data is seamlessly accepted into Splunk, that it can be fluidly searched in isolation and in combination with other Splunk-aggregated data, and that continued interoperability is maintained with existing Enterprise Apps.
Release 2.1.0
Removed SSL input: TA no does the auto-configuration of TCP raw listener on port 4568 (for SSL) - Per Splunk TA best practices. This must now be configured manually after installation of the Bricata TA.
Updated eventtypes and tags: The TA configuration now maps eight statically named sourcetypes to CIM: suricata_alerts, bricata_malware, bro_dns, bro_web, bro_smtp, bro_conn, and bro_alerts. Tags have been added for each sourcetype.