Security information and event management (SIEM)

SIEM providers collect application logs so you can aggregate, visualize, and analyze events in real time. CMP can help configure the forwarding agents offered by SIEM providers, which ship logs back to the parent indexing server. Two integrations are supported:

• Splunk: a CMP-managed SIEM provider. Install and configure the Splunk Universal Forwarder from the CMP UI.
• Elastic: a manual integration. Install and configure Filebeat on your CMP server to ship logs to Elasticsearch.

Splunk

The Splunk SIEM provider manages the relationship between a Splunk Universal Forwarder and the remote Splunk server. From the CMP UI, you can install the Splunk Universal Forwarder and configure its essential settings.

Before you begin

CMP’s Splunk support assumes the following about your Splunk environment. If your environment differs, Splunk support may not work correctly:

• The Splunk Universal Forwarder is not already installed on your CMP server before you create a Splunk SIEM provider.
• A Splunk Universal Forwarder tarball (v7.0 or later) is copied to your CMP server under /var/ or one of its non-/tmp/ subdirectories, and is owned by the cloudbolt user: chown cloudbolt:cloudbolt /var/.../splunkforwarder-*.tgz
• The remote Splunk server (receiver) has at least one receiving port enabled. See the Splunk documentation.

Create a Splunk SIEM provider

1. In CMP, go to Admin > Security Information and Event Management (SIEM) Providers.
2. Select Add, then select Splunk Universal Forwarder.
3. Complete the form, then select Create to install and configure your Splunk instance and open its detail page.

Configuration options and limits

In CMP, you can configure these parameters on the local Splunk Universal Forwarder:

• Local authentication credentials
• Hostname and port for the remote indexing and deployment servers
• Which CMP logs are forwarded to the remote Splunk indexer

Splunk (both Enterprise and Light) and the Splunk Universal Forwarder are highly configurable, and only a subset of their options is available from CMP. For a more complex Splunk infrastructure, use the Splunk CLI at /var/opt/cloudbolt/splunkforwarder/bin/splunk or Splunk’s .conf files.

Because CMP uses the UTC time zone by default, it configures the Splunk Universal Forwarder to use UTC at installation. Change this in /var/opt/cloudbolt/splunkforwarder/etc/system/local/props.conf.

Delete a Splunk SIEM provider

Selecting Delete on a Splunk provider’s detail page does not delete the installed forwarder; it only disassociates the forwarder from CMP. To fully remove the forwarder, run:

/var/opt/cloudbolt/splunkforwarder/bin/splunk stop
rm -rf /var/opt/cloudbolt/splunkforwarder

High availability

This section describes how to configure a Splunk SIEM provider for a High Availability (HA) CMP deployment. It applies only if your HA setup includes multiple web servers. Access each web server directly (not through your load balancer) to perform these steps.

Create a provider in HA. Setup begins like the standard process. With no Splunk SIEM provider configured yet, log in to a single web server and install Splunk as described above. Once it is installed and configured, CMP can mirror the installation to your other web servers: log in to the second web server, go to the Splunk SIEM provider’s detail page, and select Install from database. Point to the Splunk Universal Forwarder tarball on that server, and an identical forwarder installs. Repeat for every web server in your HA setup.

Configuration limits in HA. Treat mirrored installations as a one-time operation, and avoid updating configuration across mirrored installations via the CMP UI, as this can cause issues with your Splunk providers. As a best practice, fully configure a single Splunk instance, freeze it, then mirror it to the other web servers. If you must change configuration after mirroring, use the Splunk CLI on your server. Useful commands:

/var/opt/cloudbolt/splunkforwarder/bin/splunk add forward-server {{hostname}}:{{port}} -auth admin:{{password}}
/var/opt/cloudbolt/splunkforwarder/bin/splunk remove forward-server {{hostname}}:{{port}} -auth admin:{{password}}
/var/opt/cloudbolt/splunkforwarder/bin/splunk set deploy-poll {{hostname}}:{{port}} -auth admin:{{password}}
/var/opt/cloudbolt/splunkforwarder/bin/splunk add monitor /path/to/file.log -auth admin:{{password}}
/var/opt/cloudbolt/splunkforwarder/bin/splunk remove monitor /path/to/file.log -auth admin:{{password}}

Delete a provider in HA. Deleting follows the same steps as above. Delete the Splunk instance through one of your web servers (which deletes the database instance), then run the two commands above to stop the service and remove the Splunk folder on each of your web servers.

Elastic

CMP does not provide a managed Elastic SIEM provider the way it does for Splunk. However, Elastic and its log shipper, Filebeat, integrate easily into your CMP workflow. This section walks through installing and configuring Filebeat on your CMP server. For more, see Elastic’s getting-started guide for Filebeat.

Install Filebeat

1. SSH into your CMP servers as the root user.
2. Install Filebeat using the yum package manager or by downloading and installing the rpm package.

Configure Filebeat

Filebeat is configured through a single .yml file at /etc/filebeat/filebeat.yml. The example below monitors all of CMP’s log files; you only need to replace your Elasticsearch and Kibana credentials. If you use Elastic Cloud or need other settings, refer to the Filebeat documentation.

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/cloudbolt/application.log
    - /var/log/cloudbolt/authentication.log
    - /var/log/cloudbolt/jobs/....log
    - /var/log/cloudbolt/jobengine.log
    - /var/log/cloudbolt/jobengine-worker....log
output.elasticsearch:
  hosts: ['{{elasticsearch_hostname}}:{{elasticsearch_port}}']
  username: '{{elasticsearch_username}}'
  password: '{{elasticsearch_password}}'
setup.kibana:
  host: '{{kibana_hostname}}:{{kibana_port}}'
  username: '{{kibana_username}}'
  password: '{{kibana_password}}'

Filebeat and CMP upgrades

You do not need to reinstall Filebeat after upgrading CMP. In some cases, an upgrade may stop the Filebeat service until you restart it manually:

service filebeat start