Skip to content

Splunk Enterprise via Logstash

These instructions provide you with the example integration of Wallarm with the Logstash log collector to further forward events to the Splunk SIEM system.

Webhooks can be used as system log sources. The number of log sources depends on the system complexity: the more components in the system, the greater number of log sources and logs. The most common logging scheme in complex systems consists of the following components:

  • Log collector: accepts logs from several sources and forwards logs to the SIEM system

  • SIEM system: used to analyze logs and monitor the system status

Webhook flow

Used resources

Wallarm Cloud IP addresses

To provide Wallarm Cloud access to your system, you may need a list of its public IP addresses. To get these addresses, request them from the Wallarm technical support team.

Note that the public IP addresses of Wallarm Cloud can change from time to time. If your experience some problems with the addresses that you currently use, request up-to-date addresses from the Wallarm technical support team.

Since the links to the Splunk Enterprise and Logstash services are cited as examples, they do not respond.

Splunk Enterprise configuration

Logstash logs are sent to Splunk HTTP Event Controller with the name Wallarm Logstash logs and other default settings:

HTTP Event Collector Configuration

To access the HTTP Event Controller, generated token 93eaeba4-97a9-46c7-abf3-4e0c545fa5cb will be used.

A more detailed description of Splunk HTTP Event Controller setup is available in the official Splunk documentation.

Logstash configuration

Logstash is configured in the logstash-sample.conf file:

  • Incoming webhook processing is configured in the input section:

    • Traffic is sent to port 5044
    • Logstash is configured to accept only HTTPS connections
    • Logstash TLS certificate signed by a publicly trusted CA is located within the file /etc/server.crt
    • Private key for TLS certificate is located within the file /etc/server.key
  • Forwarding logs to Splunk and log output are configured in the output section:

    • Logs are forwarded from Logstash to Splunk in the JSON format
    • All event logs are forwarded from Logstash to Splunk API endpoint https://109.111.35.11:8088/services/collector/raw via POST requests. To authorize requests, the HTTPS Event Collector token is used
    • Logstash logs are additionally printed on the command line (15th code line). The setting is used to verify that events are logged via Logstash
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
input {
  http { # input plugin for HTTP and HTTPS traffic
    port => 5044 # port for incoming requests
    ssl => true # HTTPS traffic processing
    ssl_certificate => "/etc/server.crt" # Logstash TLS certificate
    ssl_key => "/etc/server.key" # private key for TLS certificate
  }
}
output {
  http { # output plugin to forward logs from Logstash via HTTP/HTTPS protocol
    format => "json" # format of forwarded logs
    http_method => "post" # HTTP method used to forward logs
    url => "https://109.111.35.11:8088/services/collector/raw" # ednpoint to forward logs to
    headers => ["Authorization", "Splunk 93eaeba4-97a9-46c7-abf3-4e0c545fa5cb"] # HTTP headers to authorize requests
  }
  stdout {} # output plugin to print Logstash logs on the command line
}

A more detailed description of configuration files is available in the official Logstash documentation.

Testing Logstash configuration

To check that Logstash logs are created and forwarded to Splunk, the POST request can be sent to Logstash.

Request example:

curl -X POST 'https://logstash.example.domain.com' -H "Content-Type: application/json" -H "Authorization: Splunk 93eaeba4-97a9-46c7-abf3-4e0c545fa5cb" -d '{"key1":"value1", "key2":"value2"}'

Logstash logs:

Logstash logs

Splunk event:

Splunk events

Configuration of webhook integration

  • Webhooks are sent to https://logstash.example.domain.com

  • Webhooks are sent via POST requests

  • The webhook integration has default advanced settings

  • Webhooks sent to Webhook URLs are all available events: hits, system events, vulnerabilities, scope changes

Webhook integration with Logstash

More details on the webhook integration configuration

Example testing

To test the configuration, a new user is added in Wallarm Console:

Adding user

Logstash will log the event as follows:

Log about new user in Splunk from Logstash

The following entry will be displayed in Splunk events:

New user card in Splunk from Logstash