Integrations - SIEM

The Security Information and Event Management (SIEM) integration engine enable tenants to forward event logs in various formats to SIEM platforms or other external systems. Avanan allows integrating with multiple SIEM platforms.

Encryption - Unless configured otherwise, all events are forwarded over HTTPS.

Source IP Address

Avanan can be deployed in one of several geographic regions. The security events get forwarded from a unique static IP for each region.

The static IP address for different regions:

• United States - 34.192.247.192
• Europe - 54.247.106.52
• Australia - 52.63.125.59
• Canada -  35.182.23.24
• India -  13.126.227.67
•  United Arab Emirates - 3.29.198.97
  

Configuring SIEM Integration

To configure SIEM integration from the Avanan Portal:

1. Go to Config > Security Engines > SIEM Integration.
2. Under SIEM Integration click Configure.
3. Select the required Transport method and enter the relevant details. For more details, see Supported Transport methods.
4. Select the required Log Format.
   • JSON (Splunk HEC/CIM compatible)
   • JSON
   • JSON Flat (dot notation)
   • JSON (Rapid7, <8k characters)
   • Syslog (See Forwarding logs in syslog format)
5. (Optional) If you need to add custom fields to every event forwarded from Avanan to your SIEM platform:
   1. Select the Add custom field checkbox.
   2. Enter the required Custom field name.
   3. Enter the required Custom field value.
      Note - You can add only up to five custom fields.
6. Click Save.

Note - After configuring SIEM integration from the Avanan Portal, Avanan starts sending logs. You have to configure your SIEM platform to receive logs from Avanan.

Supported Transport Methods

Forwarding Logs in Syslog Format

• Syslog messages are RFC 5424 compliant.
• If you need to limit the syslog message size, select the Limit syslog message format checkbox, and under Limit syslog message length (bytes), enter the message limit in bytes.
  
• If you need to add authentication token to all the syslog messages, enter the token under Token (optional).
• If you want to use your organization's own Certificate Authority certificate (CA certificate) with the TCP transport method, contact Avanan Support.

Supported Security Events for SIEM

Avanan supports to send these security events to the integrated SIEM platforms:

• Phishing
• Suspected Phishing
• User Reported Phishing
• Malware
• Suspected Malware
• Malicious URL
• Malicious URL Click
• DLP
• Anomaly
• Shadow IT
• Spam

Notes:

• Avanan generates logs for each one of these security events.
• Avanan does not add sensitive data to the DLP SIEM logs.

For more details about configuring AWS S3 to receive logs from Avanan, see Configuring AWS S3 to Receive Avanan Logs.

For more details about configuring AWS S3 to send logs to Splunk, see Configuring AWS S3 to Send Avanan Logs.

Recommended Configuration for known SIEM Platforms

Avanan can integrate with a large number of SIEM platforms.

Note - If you need help in configuring your SIEM platform to integrate with Avanan, contact Avanan Support.

These are the recommended configuration for some of the SIEM platforms.