Integrations - SIEM / SOAR

Avanan allows integration with multiple Security Information and Event Management (SIEM) platforms and Cortex XSOAR by Palo Alto Networks.

Encryption - For SIEM, unless configured otherwise, all events are forwarded over HTTPS.

Source IP Address

Avanan can be deployed in one of several geographic regions. The security events get forwarded from a unique static IP for each region.

The static IP address for different regions:

• United States - 34.192.247.192
• Europe - 54.247.106.52
• Australia * - 52.63.125.59
• Canada -  35.182.23.24
• India * -  13.126.227.64
•  United Arab Emirates * - 3.29.198.97
  

* These regions are relevant only for tenants created using the Avanan MSP Portal.

Configuring SIEM Integration

To configure SIEM integration from the Avanan Portal:

1. Go to Security Settings > Security Engines.
2. Under SIEM Integration click Configure.
3. Select the required Transport method and enter the relevant details. For more details, see Supported Transport methods.
4. Select the required Log Format.
   • JSON (Splunk HEC/CIM compatible)
   • JSON (CIM compatible)
   • JSON
   • JSON Flat (dot notation)
   • JSON (Rapid7, <8k characters)
   • JSON (Google UDM Compatible)
   • Syslog (See Forwarding logs in syslog format)
   • Google Chronicle Unstructured logs
5. (Optional) If you need to add custom fields to every event forwarded from Avanan to your SIEM platform:
   1. Select the Add custom field checkbox.
   2. Enter the required Custom field name.
   3. Enter the required Custom field value.
      Note - You can add only up to five custom fields.
6. Click Save.

Note - After configuring SIEM integration from the Avanan Portal, Avanan starts sending logs. You have to configure your SIEM platform to receive logs from Avanan.

Supported Transport Methods

Forwarding Logs in Syslog Format

• Syslog messages are RFC 5424 compliant.
• If you need to limit the syslog message size, select the Limit syslog message format checkbox, and under Limit syslog message length (bytes), enter the message limit in bytes.
  
• If you need to add authentication token to all the syslog messages, enter the token under Token (optional).
• If you want to use your organization's own Certificate Authority certificate (CA certificate) with the TCP transport method, contact Avanan Support.

Supported Security Events for SIEM

Avanan supports to send these security events to the integrated SIEM platforms:

• Phishing
• Suspected Phishing
• User Reported Phishing
• Malware
• Suspected Malware
• Malicious URL
• Malicious URL Click
• DLP
• Shadow IT
• Spam

Notes:

• Avanan generates logs for each one of these security events.
• Avanan does not add sensitive data to the DLP SIEM logs.

For more details about configuring AWS S3 to receive logs from Avanan, see Configuring AWS S3 to Receive Avanan Logs.

For more details about configuring AWS S3 to send logs to Splunk, see Configuring AWS S3 to Send Avanan Logs.

Recommended Configuration for known SIEM Platforms

Avanan can integrate with a large number of SIEM platforms.

Note - If you need help in configuring your SIEM platform to integrate with Avanan, contact Avanan Support.

These are the recommended configuration for some of the SIEM platforms.

Configuring Integration with Cortex XSOAR by Palo Alto Networks

Avanan allows integration with Cortex XSOAR to automatically trigger playbooks based on detected security events and other criteria. For more information about the integration, see Cortex XSOAR documentation.