Splunk Integration

Splunk Integration with TigerTrust

TigerTrust integrates with Splunk to provide enterprise security analytics for certificate lifecycle management. Forward events, create custom dashboards, and leverage Splunk's powerful analytics for certificate security.

HTTP Event Collector Setup

Configure Splunk HEC:

yaml
1# TigerTrust Splunk configuration
2integrations:
3  splunk:
4    enabled: true
5    hec_url: https://splunk.example.com:8088
6    hec_token: ${SPLUNK_HEC_TOKEN}
7    index: tigertrust
8    source: tigertrust
9    sourcetype: tigertrust:events
10
11    tls:
12      verify: true
13      ca_cert: /path/to/splunk-ca.pem

Event Schema

TigerTrust sends CIM-compliant events:

json
1{
2  "time": 1710504600,
3  "host": "tigertrust-prod",
4  "source": "tigertrust",
5  "sourcetype": "tigertrust:certificate",
6  "index": "tigertrust",
7  "event": {
8    "action": "certificate_renewed",
9    "category": "certificate",
10    "certificate": {
11      "common_name": "api.example.com",
12      "serial_number": "0x1234567890",
13      "issuer": "DigiCert",
14      "not_before": "2024-03-15T00:00:00Z",
15      "not_after": "2025-03-15T00:00:00Z",
16      "key_type": "RSA",
17      "key_size": 2048
18    },
19    "user": "[email protected]",
20    "src_ip": "10.0.0.50",
21    "result": "success",
22    "environment": "production"
23  }
24}

Custom Dashboards

TigerTrust provides pre-built Splunk dashboards:

xml
1<dashboard>
2  <label>TigerTrust Certificate Overview</label>
3
4  <row>
5    <panel>
6      <title>Certificates by Status</title>
7      <chart>
8        <search>
9          <query>
10            index=tigertrust sourcetype="tigertrust:certificate"
11            | stats count by status
12          </query>
13        </search>
14        <option name="charting.chart">pie</option>
15      </chart>
16    </panel>
17
18    <panel>
19      <title>Expiring Certificates (30 days)</title>
20      <table>
21        <search>
22          <query>
23            index=tigertrust sourcetype="tigertrust:certificate"
24            | where days_until_expiry <= 30
25            | table common_name, days_until_expiry, environment, issuer
26            | sort days_until_expiry
27          </query>
28        </search>
29      </table>
30    </panel>
31  </row>
32
33  <row>
34    <panel>
35      <title>Certificate Operations Over Time</title>
36      <chart>
37        <search>
38          <query>
39            index=tigertrust sourcetype="tigertrust:events"
40            | timechart count by action
41          </query>
42        </search>
43        <option name="charting.chart">area</option>
44      </chart>
45    </panel>
46  </row>
47</dashboard>

Alert Configuration

Create alerts for certificate events:

spl
1# Critical: Certificate Expired
2index=tigertrust sourcetype="tigertrust:certificate" action="certificate_expired"
3| stats count by common_name, environment
4| where environment="production"
5
6# Warning: Certificate Expiring Soon
7index=tigertrust sourcetype="tigertrust:certificate"
8| where days_until_expiry <= 7 AND environment="production"
9| table common_name, days_until_expiry, issuer
10
11# Security: Unauthorized Certificate Operation
12index=tigertrust sourcetype="tigertrust:audit" result="denied"
13| stats count by user, action, src_ip
14| where count > 5

Enterprise Security Integration

Integrate with Splunk ES:

spl
1# Notable event for certificate policy violation
2| makeresults
3| eval action="tigertrust_policy_violation"
4| eval severity="high"
5| eval source="tigertrust"
6| eval type="certificate"
7| sendalert notable

Splunk SOAR Playbooks

Automate response with SOAR:

python
1# SOAR playbook for certificate expiration
2def on_certificate_expiring(container):
3    # Get certificate details
4    cert = phantom.get_container_data(container)
5
6    # Check if auto-renewal is possible
7    if cert['auto_renew_enabled']:
8        phantom.act('renew_certificate',
9                   target='tigertrust',
10                   parameters={'cert_id': cert['id']})
11    else:
12        # Create ticket
13        phantom.act('create_ticket',
14                   target='servicenow',
15                   parameters={
16                       'short_description': f"Renew certificate: {cert['common_name']}",
17                       'urgency': 'high'
18                   })
19
20        # Notify team
21        phantom.act('send_message',
22                   target='slack',
23                   parameters={
24                       'channel': '#cert-alerts',
25                       'message': f"Certificate {cert['common_name']} needs manual renewal"
26                   })

Compliance Reporting

Generate compliance reports:

spl
1# Certificate compliance report
2index=tigertrust sourcetype="tigertrust:certificate"
3| eval compliant=if(key_size>=2048 AND algorithm!="SHA1", "Yes", "No")
4| stats count by environment, compliant
5| xyseries environment compliant count
6
7# Audit trail report
8index=tigertrust sourcetype="tigertrust:audit"
9| table _time, user, action, certificate.common_name, result, src_ip
10| sort -_time

Achieve comprehensive certificate security analytics with TigerTrust and Splunk.