Splunk Enterprise Security

Overview

Splunk is a software platform used for monitoring, searching, analyzing, and visualizing machine-generated log data in real-time. Splunk provides insights to technology infrastructure, security systems, and various business applications that help drive operational performance and business results.

Splunk ES was developed to help make sense of machine-generated log data, and has become a popular choice among Security Information and Event Management (SIEM) solutions for many organizations worldwide. It is primarily used for searching, monitoring, and examining Big Data through a web-style interface.

The Splunk Enterprise integration for Maltego combines the full advantage of the Splunk Common Information Model (CIM) with the investigative capabilities of link analysis.

Using Splunk, SOC teams and cyber security and threat analysts alike can easily query the following CIM data models:

• Authentication
• Endpoint
• Malware
• Network Resolution
• Network Sessions
• Network Traffic
• Vulnerabilities

Investigators can also perform raw searches, using Splunk’s Search Processing Language to get other events that may not yet be part of the data models.

Be sure to read our blog post: SIEM-plifying Investigations with Splunk and Maltego to learn more about how to leverage Splunk data and explore a use case showing how the Splunk Enterprise Security Transforms can query the Authentication data model, thus allowing you to retrieve information from authentication sources such as Active Directory (AD) directly on Maltego.

You can read more about the Splunk integration in the Hub item detail page on our website here.

Installation Guidelines

For customers with an internet-facing Splunk instance, simply install the Hub item and enter your details. For customers without an internet-facing Splunk instance, email support@maltego.com or reach out to us using the contact form on this page.

If you are a Maltego commeruser and are interested in learning how to integrate Splunk Enterprise into Maltego within your organization, email us at support@maltego.com Our integration experts are happy to discuss your needs and support the integration process!

Configuration Requirements

To enable the Maltego Splunk Enterprise Security Transforms to work, the Splunk Administrator must configure the following:

Common Information Model

1. Enable the Common Information Model. Please refer to the Splunk User Setup - Common Information Model Add-on Documentation.

Authentication

The default Splunk ES role ESS_USER will be able to access the Transforms. The ideal authentication setup is as follows:

1. Create a custom user profile with an ess_user role that allows the SPLUNK REST API to search data. Please refer to the Splunk Admin Management Documentation.
2. The Transforms can be authenticated using a username and password, or a security token. Either of these can be created for authentication, please ensure that one is enabled should it be missing.

Troubleshooting

Should you experience failure to access the Transforms, please check that the following READ permissions are present.

Set the READ permissions for the following objects:

1. Apps
2. Custom Search Commands
3. Search Scripts

Should you require additional support, please refer to the Splunk Object Permission Settings Documentation.

Splunk Enterprise Security Transforms

To Action (Phrase)

Description

Returns the value of the field ‘action’ as a Phrase Entity

Transform Meta Info

Variants

To Signature (Phrase)

Description

Returns the value of the field ‘signature’ as a Phrase Entity

Transform Meta Info

Variants

To SrcIp (IPv4Address)

Description

Returns the value of the field ‘src_ip’ as a IPv4Address Entity

Transform Meta Info

Variants

To SrcIp (IPv6Address)

Description

Returns the value of the field ‘src_ip’ as a IPv6Address Entity

Transform Meta Info

Variants

To SrcNtHost (Domain)

Description

Returns the value of the field ‘src_nt_host’ as a Domain Entity

Transform Meta Info

To DestIp (IPv4Address)

Description

Returns the value of the field ‘dest_ip’ as a IPv4Address Entity

Transform Meta Info

Variants

To DestIp (IPv6Address)

Description

Returns the value of the field ‘dest_ip’ as a IPv6Address Entity

Transform Meta Info

Variants

To DestNtHost (Domain)

Description

Returns the value of the field ‘dest_nt_host’ as a Domain Entity

Transform Meta Info

To User (Alias)

Description

Returns the value of the field ‘user’ as a Alias Entity

Transform Meta Info

Variants

To Src (IPv4Address)

Description

Returns the value of the field ‘src’ as a IPv4Address Entity

Transform Meta Info

Variants

To Src (IPv6Address)

Description

Returns the value of the field ‘src’ as a IPv6Address Entity

Transform Meta Info

Variants

To Dest (IPv4Address)

Description

Returns the value of the field ‘dest’ as a IPv4Address Entity

Transform Meta Info

Variants

To Dest (IPv6Address)

Description

Returns the value of the field ‘dest’ as a IPv6Address Entity

Transform Meta Info

Variants

To ProcessHash (Hash)

Description

Returns the value of the field ‘process_hash’ as a Hash Entity

Transform Meta Info

To UserId (Alias)

Description

Returns the value of the field ‘user_id’ as a Alias Entity

Transform Meta Info

Variants

To Description (Phrase)

Description

Returns the value of the field ‘description’ as a Phrase Entity

Transform Meta Info

To ServiceDllHash (Hash)

Description

Returns the value of the field ‘service_dll_hash’ as a Hash Entity

Transform Meta Info

To ServiceHash (Hash)

Description

Returns the value of the field ‘service_hash’ as a Hash Entity

Transform Meta Info

To FileHash (Hash)

Description

Returns the value of the field ‘file_hash’ as a Hash Entity

Transform Meta Info

Variants

To FileName (Phrase)

Description

Returns the value of the field ‘file_name’ as a Phrase Entity

Transform Meta Info

Variants

To Url (URL)

Description

Returns the value of the field ‘url’ as a URL Entity

Transform Meta Info

Variants

To Cve (CVE)

Description

Returns the value of the field ‘cve’ as a CVE Entity

Transform Meta Info

To Dvc (Alias)

Description

Returns the value of the field ‘dvc’ as a Alias Entity

Transform Meta Info

Variants

To DestNtDomain (Domain)

Description

Returns the value of the field ‘dest_nt_domain’ as a Domain Entity

Transform Meta Info

Variants

To SrcNtDomain (Domain)

Description

Returns the value of the field ‘src_nt_domain’ as a Domain Entity

Transform Meta Info

To SrcUserId (Alias)

Description

Returns the value of the field ‘src_user_id’ as a Alias Entity

Transform Meta Info

To App (Phrase)

Description

Returns the value of the field ‘app’ as a Phrase Entity

Transform Meta Info

Variants

To SrcUser (Alias)

Description

Returns the value of the field ‘src_user’ as a Alias Entity

Transform Meta Info

Variants

To DestTranslatedIp (IPv4Address)

Description

Returns the value of the field ‘dest_translated_ip’ as a IPv4Address Entity

Transform Meta Info

To DestTranslatedIp (IPv6Address)

Description

Returns the value of the field ‘dest_translated_ip’ as a IPv6Address Entity

Transform Meta Info

To DvcIp (IPv4Address)

Description

Returns the value of the field ‘dvc_ip’ as a IPv4Address Entity

Transform Meta Info

To DvcIp (IPv6Address)

Description

Returns the value of the field ‘dvc_ip’ as a IPv6Address Entity

Transform Meta Info

To SrcTranslatedIp (IPv4Address)

Description

Returns the value of the field ‘src_translated_ip’ as a IPv4Address Entity

Transform Meta Info

To SrcTranslatedIp (IPv6Address)

Description

Returns the value of the field ‘src_translated_ip’ as a IPv6Address Entity

Transform Meta Info

To Ssid (Phrase)

Description

Returns the value of the field ‘ssid’ as a Phrase Entity

Transform Meta Info

To Time (DateTime)

Description

Returns the value of the field ’_time’ as a DateTime Entity

Transform Meta Info

To All Interesting Fields

Description

Extracts interesting fields from the incoming Entity properties

Transform Meta Info

Get All Sessions Events by src_ip [Splunk]

Transform Settings

Transform Meta Info

Variants

Get All Sessions Events by dest_ip [Splunk]

Transform Settings

Transform Meta Info

Variants

Get All Sessions Events by user [Splunk]

Description

This Transform returns AllSessions events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user in a network session event where applicable. For example a VPN session or an authenticated DHCP event.’

Transform Settings

Transform Meta Info

Get Session Start Events by src_ip [Splunk]

Transform Settings

Transform Meta Info

Variants

Get Session End Events by src_ip [Splunk]

Transform Settings

Transform Meta Info

Variants

Get Dhcp Events by src_ip [Splunk]

Transform Settings

Transform Meta Info

Variants

Get Vpn Events by src_ip [Splunk]

Transform Settings

Transform Meta Info

Variants

Get Dns Events by src [Splunk]

Transform Settings

Transform Meta Info

Variants

Get Ports Events by src [Splunk]

Transform Settings

Transform Meta Info

Variants

Get Ports Events by user [Splunk]

Description

This Transform returns Ports events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user account associated with the listening port.’

Transform Settings

Transform Meta Info

Get Processes Events by user_id [Splunk]

Description

This Transform returns Processes events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique identifier of the user account which spawned the process.’

Transform Settings

Transform Meta Info

Get Processes Events by user [Splunk]

Description

This Transform returns Processes events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user account which spawned the process.’

Transform Settings

Transform Meta Info

Get Processes Events by process_hash [Splunk]

Description

This Transform returns Processes events where the field ‘ProcessHash’ is equal to the value of the input Hash.The CIM defines the field name ProcessHash as ‘The digest(s) of the parent process such as etc.’

Transform Settings

Transform Meta Info

Get Services Events by user [Splunk]

Description

This Transform returns Services events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user account associated with the service.’

Transform Settings

Transform Meta Info

Get Services Events by service_dll_hash [Splunk]

Description

This Transform returns Services events where the field ‘ServiceDllHash’ is equal to the value of the input Hash.The CIM defines the field name ServiceDllHash as ‘The digest(s) of the dynamic link library associated with the service such as etc.’

Transform Settings

Transform Meta Info

Get Services Events by service_hash [Splunk]

Description

This Transform returns Services events where the field ‘ServiceHash’ is equal to the value of the input Hash.The CIM defines the field name ServiceHash as ‘The digest(s) of the service such as etc.’

Transform Settings

Transform Meta Info

Get Filesystem Events by user [Splunk]

Description

This Transform returns Filesystem events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user account associated with the filesystem access.’

Transform Settings

Transform Meta Info

Get Filesystem Events by file_hash [Splunk]

Description

This Transform returns Filesystem events where the field ‘FileHash’ is equal to the value of the input Hash.The CIM defines the field name FileHash as ‘A cryptographic identifier assigned to the file object affected by the event.’

Transform Settings

Transform Meta Info

Get Registry Events by user [Splunk]

Description

This Transform returns Registry events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user account associated with the registry access.’

Transform Settings

Transform Meta Info

Get Vulnerabilities Events by user [Splunk]

Description

This Transform returns Vulnerabilities events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user involved in the discovered vulnerability.’

Transform Settings

Transform Meta Info

Get Vulnerabilities Events by dvc [Splunk]

Description

This Transform returns Vulnerabilities events where the field ‘Dvc’ is equal to the value of the input Alias.The CIM defines the field name Dvc as ‘The system that discovered the vulnerability. You can alias this from more specific fields such as dvc_host dvc_ip or dvc_name.’

Transform Settings

Transform Meta Info

Get Vulnerabilities Events by url [Splunk]

Description

This Transform returns Vulnerabilities events where the field ‘Url’ is equal to the value of the input URL.The CIM defines the field name Url as ‘The URL involved in the discovered vulnerability.’

Transform Settings

Transform Meta Info

Get High Critical Vulnerabilities Events by user [Splunk]

Description

This Transform returns HighCriticalVulnerabilities events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user involved in the discovered vulnerability.’

Transform Settings

Transform Meta Info

Get High Critical Vulnerabilities Events by url [Splunk]

Description

This Transform returns HighCriticalVulnerabilities events where the field ‘Url’ is equal to the value of the input URL.The CIM defines the field name Url as ‘The URL involved in the discovered vulnerability.’

Transform Settings

Transform Meta Info

Get Medium Vulnerabilities Events by user [Splunk]

Description

This Transform returns MediumVulnerabilities events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user involved in the discovered vulnerability.’

Transform Settings

Transform Meta Info

Get Medium Vulnerabilities Events by url [Splunk]

Description

This Transform returns MediumVulnerabilities events where the field ‘Url’ is equal to the value of the input URL.The CIM defines the field name Url as ‘The URL involved in the discovered vulnerability.’

Transform Settings

Transform Meta Info

Get Low Informational Vulnerabilities Events by user [Splunk]

Description

This Transform returns LowInformationalVulnerabilities events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The user involved in the discovered vulnerability.’

Transform Settings

Transform Meta Info

Get Low Informational Vulnerabilities Events by url [Splunk]

Description

This Transform returns LowInformationalVulnerabilities events where the field ‘Url’ is equal to the value of the input URL.The CIM defines the field name Url as ‘The URL involved in the discovered vulnerability.’

Transform Settings

Transform Meta Info

Get Authentication Events by src [Splunk]

Transform Settings

Transform Meta Info

Variants

Get Authentication Events by src_user_id [Splunk]

Description

This Transform returns Authentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Authentication Events by src_user [Splunk]

Description

This Transform returns Authentication events where the field ‘SrcUser’ is equal to the value of the input Alias.The CIM defines the field name SrcUser as ‘In privilege escalation events src_user represents the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Authentication Events by user_id [Splunk]

Description

This Transform returns Authentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Authentication Events by user [Splunk]

Description

This Transform returns Authentication events where the field ‘User’ is equal to the value of the input Alias.The CIM defines the field name User as ‘The name of the user involved in the event or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Failed Authentication Events by src_user_id [Splunk]

Description

This Transform returns FailedAuthentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Failed Authentication Events by user_id [Splunk]

Description

This Transform returns FailedAuthentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Successful Authentication Events by src_user_id [Splunk]

Description

This Transform returns SuccessfulAuthentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Successful Authentication Events by user_id [Splunk]

Description

This Transform returns SuccessfulAuthentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Default Authentication Events by src_user_id [Splunk]

Description

This Transform returns DefaultAuthentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Default Authentication Events by user_id [Splunk]

Description

This Transform returns DefaultAuthentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Failed Default Authentication Events by src_user_id [Splunk]

Description

This Transform returns FailedDefaultAuthentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Failed Default Authentication Events by user_id [Splunk]

Description

This Transform returns FailedDefaultAuthentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Successful Default Authentication Events by src_user_id [Splunk]

Description

This Transform returns SuccessfulDefaultAuthentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Successful Default Authentication Events by user_id [Splunk]

Description

This Transform returns SuccessfulDefaultAuthentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Insecure Authentication Events by src_user_id [Splunk]

Description

This Transform returns InsecureAuthentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Insecure Authentication Events by user_id [Splunk]

Description

This Transform returns InsecureAuthentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Privileged Authentication Events by src_user_id [Splunk]

Description

This Transform returns PrivilegedAuthentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Privileged Authentication Events by user_id [Splunk]

Description

This Transform returns PrivilegedAuthentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Failed Privileged Authentication Events by src_user_id [Splunk]

Description

This Transform returns FailedPrivilegedAuthentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Failed Privileged Authentication Events by user_id [Splunk]

Description

This Transform returns FailedPrivilegedAuthentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get Successful Privileged Authentication Events by src_user_id [Splunk]

Description

This Transform returns SuccessfulPrivilegedAuthentication events where the field ‘SrcUserId’ is equal to the value of the input Alias.The CIM defines the field name SrcUserId as ‘The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.’

Transform Settings

Transform Meta Info

Get Successful Privileged Authentication Events by user_id [Splunk]

Description

This Transform returns SuccessfulPrivilegedAuthentication events where the field ‘UserId’ is equal to the value of the input Alias.The CIM defines the field name UserId as ‘The unique id of the user involved in the event. For authentication privilege escalation events this should represent the user targeted by the escalation.’

Transform Settings

Transform Meta Info

Get All Traffic Events by src_ip [Splunk]

Transform Settings