SIEM Integration
'SIEM Integration' option allows you to forward data from ADSelfServicePlus to an external SIEM product or to a Syslog Server in real time.
Forwarding ADSelfService Plus data to a Syslog Server
Syslog is the event logging service in unix systems.You may also use this setting to forward to your SIEM's UDP or TCP Receiver.
Configuring a Syslog Server:
- Syslog daemon runs by default in udp, port 514.
- The default settings can be modified in its configuration file /etc/syslog.conf . Remember to restart Syslog daemon for the changes to take effect.
Steps to enable Syslog Logging in ADSelfServicePlus:
- Click on 'Admin' Tab → 'Product Settings' → 'Integration Settings'
- Click the 'Syslog' Tile.
- Enter the Syslog server name. Ensure that the Syslog server is reachable from the ADSelfServicePlus server.
- Enter Syslog port number and protocol.
- Choose Syslog standard and data format as required by your SIEM Parser.
- Click on Save
Forwarding ADSelfService Plus data to an external SIEM product : Splunk HTTP
Configuring Splunk Http Event Collector:
- Click on 'Settings' → 'Data Inputs' → 'Http Event Collector'.
- Click 'New Token'. Provide a name for the token(Preferably ADSelfServicePlus) and leave the rest to the default values(Customize if required).
- After saving the configuration, an auth token will be generated. This token needs to be provided in ADSelfServicePlus configuration.
- Under 'Global Settings' in the 'Http Event Collector' page, Enable 'All tokens'.
- You can also customize 'Http port number' and 'SSL' settings as required in the 'Global Settings'.
Steps to enable Splunk Logging in ADSelfServicePlus:
- Click on 'Admin' Tab → 'Product Settings' → 'Integration Settings'
- Click the 'Splunk' Tile.
- Enter the Splunk Server name. Ensure that the Splunk Server is reachable from the ADSelfServicePlus Server.
- Enter Splunk Http Event Collector port number and protocol.
- Specify the Http Event Collector token generated in Splunk for ADSelfServicePlus.
- Click on Save.
To search for ADSelfServicePlus Data in your SIEM product
The forwarded ADSelfService Plus events can be searched, grouped into reports and categorized as needed in your SIEM product.
- Events from ADSelfServicePlus can be easily separated by the 'SOURCE' field.
- Each log event will have a 'Category' field. The possible values for this field are defined under 'Choose categories to forward' menu in the configuration page.
- Timestamp of each event will be available in the 'TIME_GENERATED' field.
- Other fields pertaining to events may vary depending on the event category. So one regex can be maintained for each of the required categories in your SIEM product.