Integrating with Security Information and Event Management (SIEM) using CLI

Integrating Network Detection and Response NDR with SIEM provides real-time visibility of all activities on your systems, networks, databases, and applications.

Log into the NDR CLI using a terminal window or SSH client:
1. Using the NDR SSH protocol, log into the appliance with management interface's IP address or hostname.
```
$ ssh npadmin@<NDR IP address>
```
2. Enter the password when prompted. The hostname > prompt is displayed after you have logged in.
Enter privileged mode on the NDR CLI.
```
npadmin@hostname> enable
```
Enter the npadmin password, when prompted. The password can be 5 to 24 characters long.
```
[sudo] password for npadmin: <password>
```
Enter configuration mode.
```
npadmin@hostname# configure system
```
The prompt changes to npadmin@hostname(config)# on the terminal indicating that configuration mode is enabled.
Type SIEM at the terminal and press Enter.
In the SIEM Configuration page, type 1 and then press Enter to configure consumers.
Type 1 and press Enter to configure Splunk. The Configure Splunk options are displayed.
1. Type A and press Enter to add a Spunk server.
2. Type 1 and press Enter. Provide a name for the server.
3. Type 2 and press Enter to specify IP address (IP address of Splunk server).
4. Type 3 and press Enter. Specify the port on which Splunk is listening for HTTP Event Collector (HEC) logs.
5. Type 4 and press Enter. Specify Hec token. This is the HTTP Event Collector token in Splunk, which you will need to generate within the Splunk interface. The token is used to authenticate the Network Detection and Response system when sending logs.
6. Type 5 and press Enter to export from NDRC to Splunk.
7. Type 6 and press Enter to enable the export of events or alerts over https to Splunk.
8. Type 7 and press Enter to configure alerts.
9. Type 8 and press Enter to configure L7 metadata.
10. Type X and press Enter to save the settings and return to the previous page.
11. Type C and press Enter if you want to cancel the settings and return to the previous page.
12. From configure Splunk menu, type the required number beside the configured Splunk server and press Enter to edit the server details.
  Note
  The connection status of the Splunk server (whether the server is up or down) can be verified using the Check Health Status feature option available in the Edit Server page.
13. Type X and press Enter to save the settings and return to the Configure Spunk page.
14. Type X and press Enter to save the settings and return to the Configure SIEMs to export metadata and alert page.
  Note
  Alerts generated or stored in the NDR Console are forwarded to Splunk only when the following conditions are satisfied:
  - Alert forwarding is enabled in the Splunk configuration.
  - The alert severity meets or exceeds the configured severity threshold. Only alerts whose severity is equal to or higher than the configured threshold are forwarded.
To configure other parameters, type 2 and press Enter.
1. Type 1 and press Enter to specify the batch size.
2. Type 2 and press Enter to specify the export interval. This is the time elapsed since the previous export surpasses the defined export interval.
  Important
  NDR allows you to set both a batch size and an export interval. Data is exported to Splunk if either of the following conditions are met:
  - The amount of specific data received by NDR that needs to be exported exceeds the configured batch size.
  - The time elapsed since the previous export is greater than the defined export interval.
3. Type X and press Enter to save the settings and exit.
4. Type C and press Enter to cancel the settings and return to the previous page.
Type X and press Enter to exit the configure SIEM page.

Note
If HTTPS is enabled, you must upload certificates (generated on Splunk server) in NDR using following APIs:
curl -k -u npadmin:Fireeye@123 https://NDRC_IP/config/v1/siem/Splunk/cert/<configuration name> -XPOST -F "cert=@ca.pem
curl -k -u npadmin:Fireeye@123 https://NDRC_IP/config/v1/siem/Splunk/cert/<configuration name> -XPOST F "cert=@client cert.pem
where <configuration name> is the name of an integration or confguration that is given in step 7b.

Alert severity threshold behavior

Configured Severity	Alerts forwarded
Low	Low, Medium, High, Critical
Medium	Medium, High, Critical
High	High, Critical
Critical	Critical only