One Identity Safeguard for Privileged Sessions 7.0.1.1 LTS - REST API Reference Guide

SPS can forward session data to Splunk near real-time. Using the One Identity Safeguard for Privileged Sessions App for Splunk you can integrate this data with your other sources, and access all your data related to privileged user activities from a single interface. To configure SPS to forward session data to Splunk, complete the following steps.

Prerequisites and restrictions:

• SPS version 5 F5 or later

• Splunk version 6.5 or later

• SPS does not send historical data to Splunk, only data from the sessions started after you complete this procedure.

URL

GET https://<IP-address-of-SPS>/api/configuration/management/splunk_forwarder

Cookies

Sample request

The following command lists the endpoints for SNMP configuration settings.

curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/management/splunk_forwarder

Response

The following is a sample response received when querying the endpoint.

For more information on the meta object, see Message format.

{
"body": {
    "enabled": true,
    "flush_interval": 600,
    "host":
        { "selection": "fqdn", "value": "splunk.example.com" },
    "pam_address":
        { "selection": "fqdn", "value": "scb.example.com" },
    "port": 8088,
    "ssl":
        { "selection": "insecure" },
    "token": "2134356431"
    }
}

"host":
    { "selection": "fqdn", "value": "splunk.example.com" },

"host":
    { "selection": "ip", "value": "192.168.1.1" },

Configure Splunk forwarder

1. Install the One Identity Safeguard for Privileged Sessions App for Splunk to your Splunk installation. This will automatically enable and configure the HTTP Event Collector (HEC) in your Splunk installation, and create an HTTP Event Collector authentication token ("HEC token") that SPS will use.

   To help identify the source of the received data, the following settings are configured automatically in the One Identity Safeguard for Privileged Sessions App for Splunk:

   • index: The One Identity Safeguard for Privileged Sessions App for Splunk creates the index automatically, with the name balabit_events.

   • sourcetype: The source type of the events the SPS fowards is balabit:event.

2. On your Splunk interface, navigate to Settings > Data inputs > HTTP Event Collector. Copy the Token Value from the Balabit_HEC field. This is the HTTP Event Collector authentication token and you will need it when configuring SPS.

3. Create the JSON object that configures SPS to forward session data to Splunk.

   POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/management/splunk_forwarder endpoint. You can find a detailed description of the available parameters listed in Elements of remote_desktop_gateway. For example,

   {
       "enabled": true,
       "flush_interval": 600,
       "host":
           { "selection": "fqdn", "value": "splunk.example.com" },
       "pam_address":
           { "selection": "fqdn", "value": "psm.example.com" },
       "port": 8088,
       "ssl":
           { "selection": "insecure" },
       "token": "2134356431"
   }

4. Commit your changes.

   For more information, see Commit a transaction.

5. Splunk will display the data received from SPS as it was received from the host set in the pam_address field. By default, this is the hostname and domain name of the SPS appliance as set on the /api/configuration/network/naming endpoint. Adjust this field as needed for your environment.

6. Start a session that SPS will audit to test your configuration, and verify that the data of the session appears in Splunk.