Integrate Contrast Security ADR with Splunk

The Contrast Security ADR integration with Splunk enables ADR to send incident details to your SIEM (Security Information and Event Management), SOAR (Security orchestration, automation and response), and XDR (Extended Detection and Response) environments, contextualizing incidents with other threat detection and response solutions.

How it works

When configured, the Contrast Security ADR for Splunk app sends detected attack events and observations from the Contrast Security platform to a Splunk HTTP Event Collector.

The Contrast Security ADR for Splunk app on splunkbase.com enables Splunk to:

Parse and normalize the data received over the HTTP Event Collector
Display Contrast Security ADR dashboards, reports, and searches in Splunk
Provide runbooks to assist SOC Analysts in resolving AppSec-related security incidents

Before you begin

Before you start, you must have:

Splunk Enterprise 9.2. See the installation guide for information.
Splunk CIM (Common Information Model) 5.x and later
Applications instrumented with a Contrast agent

Step 1: Install the Contrast ADR app in Splunk

Install from the Marketplace

In Splunk Enterprise, select Apps and select Find more apps.
Search for Contrast Security ADR for Splunk 1.0.
Check the requirements.
Select Install.
Continue to step 2.

After installation, you will see the Contrast Security ADR for Splunk app in the apps dropdown.

Install from a file

In Splunk Enterprise, select Apps and select Find more apps.
Search for Contrast Security ADR for Splunk 1.0.
Select download and save the file to a convenient location.
Select Manage.
Select Install app from file.
Select the app you downloaded.
Optionally, select Upgrade app if you previously installed the Contrast Security ADR app.
Select Upload.
Continue to step 2,

After installation, you will see the Contrast Security ADR for Splunk app in the apps dropdown.

Step 2: Set up Splunk CIM

In Splunk Enterprise, select Apps and select Find more apps.
Search for Splunk Common Information Model (CIM).
Select Install.
Enter your Splunk.com mail and password credentials.
Select the Accept and Login buttons.
Continue to step 3.

After installation, you will see the app in the apps dropdown.

Step 3: Set up an HTTP Event Collector input in Splunk

Set up an HTTP Event Collector input in Splunk for attack events

For Contrast and Northstar.

In Splunk Enterprise, go to Settings > Data Input > HTTP Event Collector.
Enter a Name to help identify the token receiving data over HTTP. Remember this name.
Select the New Token button at the top of the page.
Enter the fields and select Next.
Choose Select source type and specify contrast:adr for the source type.
Select the preferred index to store the data, likecontrast. If an index does not exist, create an index following these steps.
Select the Review button.
Select the Submit button.
Copy the token value on the success page. This will be needed for the integration in step 4.
Continue to step 4.

Set up an HTTP Event Collector input in Splunk for incidents and observations

For Northstar only.

Repeat steps 1 to 4 in the Set up an HTTP Event Collector input in Splunk for attack events section above.
In step 5, specify contrast:adr:incidents for the source type.
Repeat steps 6 to 9 in the Set up an HTTP Event Collector input in Splunk for attack events section above.
Continue to step 4.

Step 4: Configure Contrast Security ADR

Configure with Contrast

Configure the integration in Contrast to send attack events to the Splunk app.

For Contrast, go to the user menu and select Organization settings > Integrations.
Select the Splunk option under the ADR Integrations section.
Under the Splunk fields, enter the URL and token information for the destination HTTP Event Collector as configured in setting up an Event Collector for attack events. Note that the URL in the screen example is shown only for illustration purposes; refer to the official Splunk Documentation for more information.
Select Save.
Continue to step 5.

Configure with Northstar

Configure the integration in Northstar to send observations and incidents to the Splunk app.

For Northstar, in the left navigation, select Administration > Integrations.
Select the Splunk option under the Integrations section.
Under the Splunk fields:
1. Enter the URL for the destination HTTP Event Collector as configured in setting up an Event Collector for attack events. Note that the URL in the screen example is shown only for illustration purposes; refer to the official Splunk Documentation for more information.
2. Enter the HTTP Event Collector token for attack event observations as configured in setting up an HTTP Event Collector for attack events.
3. Enter the HTTP Event Collector token for incidents as configured in setting up an HTTP Event Collector for incidents and observations.
Select from the modes of data to send to Splunk:
- Select All Observations and incidents to send all attack event observations detected by agents, as well as incidents. This is recommended for SOC practices wanting to get deep visibility into application runtime and build their custom use cases.
- Select Incidents and only incident-related observations to send incidents and associated observations to the SIEM. This is recommended for SOC practices wanting to minimize the volume of data sent to their SIEM and only receive alerts for security incidents and the related observations.
Select the Integration Enabled toggle to enable the integration. This setting allows you to temporarily disable the integration without losing your configuration.
Select Save.
Continue to step 5.

Step 5: Set up macros to search for events

Macros are used to keep track of the index where Contrast Security ADR events are stored. The macro will be used for CIM mapping and correlation searches.

In Splunk Enterprise, go to Settings > Advanced Search.
Select Search macros.
Select Add new.
Search for the contrast_search macro.
Select the macro name to edit it.
Call the index name as the index provided in the HTTP Event Collector input as configured in setting up an HTTP Event Collector for attack events.
Select Save to update the macro in the index where Contrast Webhook data is stored.

To validate the macro:

In Splunk Enterprise, select Contrast Security ADR for Splunk 1.0 from the apps menu.
Select Search.
In the search box, type contrast_search.
Set the time range input to All Time.
Select Search.
You should be able to see the Contrast ADR events once the search is complete.
Continue to step 6.

Step 6: Set up CIM data models

Set up an Intrusion Detection Macro to recognize the Contrast ADR events.

In Splunk Enterprise, go to Settings > Advanced Search > Macros.
Select the Splunk Common Information Model (CIM) app.
Search for cim_Intrusion_Detection_indexes and select to edit.
Edit the definition as eventtype=contrast_adr.
Select Save.
Continue to step 7.

Step 7: View Contrast ADR data in Splunk

Splunk provides three dashboards where you can see Contrast data.

In Splunk, under Apps, find Contrast ADR for Splunk.
Select Dashboards.
Select a dashboard:
- Attack Dashboard: This dashboard shows a summary of attacks that Contrast blocked in a specified time frame, identifies which applications are targeted for attacks, the type of attacks and when they occurred, and the most frequently targeted URIs.
- Attacks by Applications: This dashboard shows the number of attacks, the different types of attacks detected and blocked, the distribution of different attack types in a specified time frame, and the top 10 most attacked URIs for the specified applications.
- Attacks Geographical Distribution: This dashboard shows a geographical view of attacks that Contrast Security detected and blocked.