Configuring integration with an SIEM system

Kaspersky Anti Targeted Attack Platform can publish information about user actions in the program web interface as well as alerts to a

You can use

If you have deployed the Central Node and Sensor components as a cluster, you can configure fault-tolerant integration with an external system using one of the following options:

• Using the Round Robin function.
• Configure the settings of the external system so that the external system switches between the IP addresses of the cluster servers if a network error occurs.

To configure the fault-tolerant integration with the external system:

1. Configure Round Robin on the DNS server for the domain name corresponding to the Central Node cluster.
2. Specify this domain name in the mail server settings.

Integration with the mail server will be configured based on the domain name. The mail server will communicate with a random server in the cluster. If this server fails, the mail server will communicate with another healthy server in the cluster.

Enabling and disabling information logging to a remote log

You can configure the logging of information about user actions in the web interface and alerts to a remote log. The log file is stored on the server on which the SIEM system is installed. To write to the remote log, you must configure the integration with the SIEM system.

To enable or disable the logging of information about user actions in the web interface and alerts to the remote log:

1. In the window of the program web interface, select the Settings section, SIEM system subsection.
2. If you want to enable / disable the recording of information about user actions in the web interface to the remote log, do one of the following:
   • If you want to enable recording of information about user actions in the web interface, select the Activity log check box.
   • If you want to disable the recording of information about user actions in the web interface, clear the Activity log check box.
3. If you want to enable / disable the recording of information about alerts to the remote log, do one of the following:
   • If you want to enable recording of alert information, select the Alerts check box.
   • If you want to disable recording of alert information, clear the Alerts check box.

   You can select both check boxes simultaneously.

4. Click Apply in the lower part of the window.

Information logging in the remote log is enabled or disabled.

Users with the Security auditor role can only view information about remote logging settings.

Configuring the main settings for SIEM system integration

To configure the main settings for SIEM system integration:

1. In the window of the program web interface, select the Settings section, SIEM system subsection.
2. Select the Activity log and/or Alerts check boxes.

   You can select one check box or both check boxes.

3. In the Host/IP field, enter the IP address or host name of the server of your SIEM system.
4. In the Port field, enter the port number used for connecting to your SIEM system.
5. In the Protocol field, select TCP or UDP.
6. In the Host ID field, enter the host ID. The host with that ID is specified as the alert source in the log of the SIEM system.
7. In the Heartbeat field, enter the interval for sending messages to the SIEM system.
8. Click Apply in the lower part of the window.

The main settings of integration with the SIEM system will be configured.

Users with the Security auditor role can only view information about the SIEM system integration settings.

Uploading a TLS certificate

To upload a TLS certificate for encrypting the connection with the SIEM system:

1. In the window of the program web interface, select the Settings section, SIEM system subsection.
2. In the TLS encryption section, click the Upload button.

   This opens the file selection window.

3. Select a TLS certificate file to download and click the Open button.

   This closes the file selection window.

   The TLS certificate will be added to the program.

4. Click Apply in the lower part of the window.

The uploaded TLS certificate will be used to encrypt the connection with the SIEM system.

Enabling and disabling TLS encryption of the connection with the SIEM system

To enable or disable TLS encryption of the connection with the SIEM system:

1. In the window of the program web interface, select the Settings section, SIEM system subsection.
2. Select the Activity log and/or Alerts check boxes.

   You can select one check box or both check boxes.

3. In the TLS encryption section, perform one of the following actions:
   • Turn on the toggle switch next to the name of the TLS encryption parameter if you want to enable TLS encryption of the connection with the SIEM system.
   • Turn off the toggle switch next to the name of the TLS encryption parameter if you want to disable TLS encryption of the connection with the SIEM system.

   The toggle switch next to the name of the TLS encryption setting can be used only if a TLS certificate is loaded.

4. Click Apply in the lower part of the window.

TLS encryption of the connection with the SIEM system will be enabled or disabled.

Content and properties of syslog messages about alerts

Information about each alert is transmitted in a separate syslog category (syslog facility) that is not used by the system to deliver messages from other sources. Information about each alert is transmitted as a separate syslog message in CEF format. If the alert was generated by the Targeted Attack Analyzer module, information about that alert is transmitted as multiple separate syslog messages in CEF format.

The default maximum size of a syslog message about an alert is 32 KB. Messages that exceed the maximum size are truncated at the end.

The header of each syslog message about an alert contains the following information:

• Format version.

  Current version number: 0. Current field value: CEF:0.

• Vendor.

  Current field value: AO Kaspersky Lab.

• Program name.

  Current field value: Kaspersky Anti Targeted Attack Platform.

• Program version.

  The current value of the field is 5.0.0-5201.

• Alert type.

  See the table below.

• Event name.

  See the table below.

• Alert importance.

  Allowed field values: Low, Medium, High or 0 (for heartbeat messages).

• Additional information.

  Example: CEF:0|AO Kaspersky Lab| Kaspersky Anti Targeted Attack Platform |5.0.0-5201|url_web| URL from web detected|Low|

The body of a syslog message about an alert matches the information about that alert that is displayed in the program web interface. All fields are presented in the format "<key>=<value>". Depending on whether the alert occurred in network traffic or mail traffic, and depending on the technology that generated the alert, various keys may be transmitted in the body of a syslog message. If the value is empty, the key is not transmitted.

The keys, as well as their values contained in a message, are presented in the table below.

Information about an alert in syslog messages

Page top