Integrations - SIEM
The Security Information and Event Management (SIEM) integration engine enable tenants to forward event logs in various formats to SIEM platforms or other external systems. Avanan allows integrating with multiple SIEM platforms.
Encryption - Unless configured otherwise, all events are forwarded over HTTPS.
Source IP Address
Avanan can be deployed in one of several geographic regions. The security events get forwarded from a unique static IP for each region.
The static IP address for different regions:
- United States - 34.192.247.192
- Europe - 54.247.106.52
- Australia - 52.63.125.59
- Canada - 35.182.23.24
- India - 13.126.227.67
- United Arab Emirates - 3.29.198.97
Configuring SIEM Integration
To configure SIEM integration from the Avanan Portal:
- Go to Config > Security Engines > SIEM Integration.
- Under SIEM Integration click Configure.
- Select the required Transport method and enter the relevant details. For more details, see Supported Transport methods.
- Select the required Log Format.
- JSON (Splunk HEC/CIM compatible)
- JSON
- JSON Flat (dot notation)
- JSON (Rapid7, <8k characters)
- Syslog (See Forwarding logs in syslog format)
- (Optional) If you need to add custom fields to every event forwarded from Avanan to your SIEM platform:
- Select the Add custom field checkbox.
- Enter the required Custom field name.
- Enter the required Custom field value.
Note - You can add only up to five custom fields.
- Click Save.
Note - After configuring SIEM integration from the Avanan Portal, Avanan starts sending logs. You have to configure your SIEM platform to receive logs from Avanan.
Supported Transport Methods
Transport Method | Required Fields |
Splunk HTTP Event Collector (HEC) | HTTP Event Collector Host / URI |
HTTP Event Collector Token | |
(Optional) To use Indexer acknowledgment, select the checkbox and enter the Channel ID. | |
(Optional) To use Splunk Index, select the checkbox and enter the Splunk index name. | |
HTTP Collector | HTTP Collector URL |
AWS S3 | AWS IAM Role ARN |
AWS S3 Bucket Name | |
AWS S3 Bucket Region | |
AWS S3 Bucket Directory Path | |
(Optional) To use External ID, select the checkbox and enter the External ID. | |
AWS SQS | AWS SQS Queue URL |
Azure Log Workspace | Azure Log Workspace ID |
Azure Log Workspace Shared Key | |
TCP | TCP Host |
TCP Port |
Forwarding Logs in Syslog Format
- Syslog messages are RFC 5424 compliant.
- If you need to limit the syslog message size, select the Limit syslog message format checkbox, and under Limit syslog message length (bytes), enter the message limit in bytes.
- If you need to add authentication token to all the syslog messages, enter the token under Token (optional).
- If you want to use your organization's own Certificate Authority certificate (CA certificate) with the TCP transport method, contact Avanan Support.
Supported Security Events for SIEM
Avanan supports to send these security events to the integrated SIEM platforms:
- Phishing
- Suspected Phishing
- User Reported Phishing
- Malware
- Suspected Malware
- Malicious URL
- Malicious URL Click
- DLP
- Anomaly
- Shadow IT
- Spam
Notes:
- Avanan generates logs for each one of these security events.
- Avanan does not add sensitive data to the DLP SIEM logs.
For more details about configuring AWS S3 to receive logs from Avanan, see Configuring AWS S3 to Receive Avanan Logs.
For more details about configuring AWS S3 to send logs to Splunk, see Configuring AWS S3 to Send Avanan Logs.
Recommended Configuration for known SIEM Platforms
Avanan can integrate with a large number of SIEM platforms.
Note - If you need help in configuring your SIEM platform to integrate with Avanan, contact Avanan Support.
These are the recommended configuration for some of the SIEM platforms.
SIEM Platform |
Transport Method |
Log Format |
---|---|---|
Splunk |
Splunk HTTP Event Collector (HEC)
|
JSON (Splunk HEC/CIM compatible) |
Rapid7 |
AWS SQS
|
JSON (Rapid7, <8k characters) |
Sumo Logic |
HTTP Collector
|
JSON |
Azure Log Workspace |
Azure Log Workspace
|
JSON |
LogRhythm |
AWS S3 For the fields required for AWS S3, see Required fields for the Transport method. If a new S3 Bucket is needed, you should follow specific instructions while configuring the S3 bucket. For more details, see Configuring AWS S3 to Receive Avanan logs. |
JSON |
McAfee SIEM |
AWS S3 For the fields required for AWS S3, see Required fields for Transport method. If a new S3 Bucket is needed, you should follow specific instructions while configuring the S3 bucket. For more details, see Configuring AWS S3 to Receive Avanan logs. To receive the logs from S3 bucket to McAfee SIEM, refer to Configuration of Amazon S3 upload feature and McAfee Documentation. |
JSON |