Table of contents.
Onboarding Guide
1. Download the application package
2. Upload the application package to the customer’s Splunk Instance
Navigate to the Splunk home page.
Click on the settings button placed on the left side of the screen, to manage apps.
On the top right corner, click on Install app from file.
Choose a file and Click on Upload.
3. Setup Application in Splunk
5. After Successful upload, the following screen will appear.
6. Click on Set up now.
7. The following screen will appear.
8. Copy token provided by Cyberready frontend for Splunk integration.
a) Log into the portal and navigate to HRM > Settings > Splunk > View configurations.
b) Once you click View configurations, click on Generate Token and then the copy icon to copy the token.
9. Paste the token into the form above and press the Submit button.
10. The following screen will appear.
4. Create an Alert and hook to Right-Hand Alert Action
11. A search query specific to logs being integrated is required here. You might need help from the SOC Team or RH Team to build this query.
NOTE: Make sure time span is set to All time (real-time)
12. Press the Search button, on the right corner of the search bar to verify that desired logs are appearing in the search, see the example below.
13. On the top-right corner, click on the Save As button and then the Alert option.
14. The Following Popup will appear, fill it with appropriate details.
NOTE: Set Alert type to Real-time and Expires to 365 days
15. Now click on the Add Actions button at the bottom. Find and select Right-Hand-Alert.
16. Click on the Save button.
17. The following screen will appear.
18. Click on View Alert to verify the alert settings. The following screen will appear.
NOTE: Make sure Alert is Enabled and Actions are set to Right-Hand-Alert.
Please refer to this article for the next steps in configuring the mapping attributes.
5. Events Supported by Right Hand via Splunk integration
Fortinet Ensilo Events
Malicious File (Fortinet Ensilo)
This event is considered by Right hand when following conditions are met in the received alerts
rules list: Dynamic Code
action: block
Netskope Events
Malicious Website (Netskope)
This event is considered by Right hand when following conditions are met in the received alerts
alert type: malsite
action: block
Crowdstrike Events
Refer this documentation to understand the conditions used to match crowdstrike events.
Adware File (Crowdstrike)
C2 Server Alert (Crowdstrike)
Malicious Document (Crowdstrike)
Spearphishing Attack (Crowdstrike)
Ransomware (Crowdstrike)
Suspicious Login (Crowdstrike)
Suspicious Credentials File (Crowdstrike)
Malware (Crowdstrike)
Suspicious Remote Access (Crowdstrike)
Unintended Java Download (Crowdstrike)
Unintended Malicious Download via Browser (Crowdstrike)
Unintended Malicious Download (Crowdstrike)
Accidental Tool Download (Crowdstrike)
Mimecast Events
Refer this documentation to understand the conditions used to match crowdstrike events.
Data Loss Prevention (Mimecast)
Malicious Email Attachment(Mimecast)
Impersonation Email(Mimecast)
Malicious URL in Email(Mimecast)
Credential Theft(Mimecast)
BEC Email Alert(Mimecast)
HTTP Policy Blocked Content(Island Browser)