Splunk Integration

Splunk Integration with TigerTrust

TigerTrust integrates with Splunk to provide enterprise security analytics for certificate lifecycle management. Forward events, create custom dashboards, and leverage Splunk's powerful analytics for certificate security.

HTTP Event Collector Setup

Configure Splunk HEC:

# TigerTrust Splunk configuration
integrations:
  splunk:
    enabled: true
    hec_url: https://splunk.example.com:8088
    hec_token: ${SPLUNK_HEC_TOKEN}
    index: tigertrust
    source: tigertrust
    sourcetype: tigertrust:events

    tls:
      verify: true
      ca_cert: /path/to/splunk-ca.pem

Event Schema

TigerTrust sends CIM-compliant events:

{
  "time": 1710504600,
  "host": "tigertrust-prod",
  "source": "tigertrust",
  "sourcetype": "tigertrust:certificate",
  "index": "tigertrust",
  "event": {
    "action": "certificate_renewed",
    "category": "certificate",
    "certificate": {
      "common_name": "api.example.com",
      "serial_number": "0x1234567890",
      "issuer": "DigiCert",
      "not_before": "2024-03-15T00:00:00Z",
      "not_after": "2025-03-15T00:00:00Z",
      "key_type": "RSA",
      "key_size": 2048
    },
    "user": "[email protected]",
    "src_ip": "10.0.0.50",
    "result": "success",
    "environment": "production"
  }
}

Custom Dashboards

TigerTrust provides pre-built Splunk dashboards:

<dashboard>
  <label>TigerTrust Certificate Overview</label>

  <row>
    <panel>
      <title>Certificates by Status</title>
      <chart>
        <search>
          <query>
            index=tigertrust sourcetype="tigertrust:certificate"
            | stats count by status
          </query>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>

    <panel>
      <title>Expiring Certificates (30 days)</title>
      <table>
        <search>
          <query>
            index=tigertrust sourcetype="tigertrust:certificate"
            | where days_until_expiry <= 30
            | table common_name, days_until_expiry, environment, issuer
            | sort days_until_expiry
          </query>
        </search>
      </table>
    </panel>
  </row>

  <row>
    <panel>
      <title>Certificate Operations Over Time</title>
      <chart>
        <search>
          <query>
            index=tigertrust sourcetype="tigertrust:events"
            | timechart count by action
          </query>
        </search>
        <option name="charting.chart">area</option>
      </chart>
    </panel>
  </row>
</dashboard>

Alert Configuration

Create alerts for certificate events:

# Critical: Certificate Expired
index=tigertrust sourcetype="tigertrust:certificate" action="certificate_expired"
| stats count by common_name, environment
| where environment="production"

# Warning: Certificate Expiring Soon
index=tigertrust sourcetype="tigertrust:certificate"
| where days_until_expiry <= 7 AND environment="production"
| table common_name, days_until_expiry, issuer

# Security: Unauthorized Certificate Operation
index=tigertrust sourcetype="tigertrust:audit" result="denied"
| stats count by user, action, src_ip
| where count > 5

Enterprise Security Integration

Integrate with Splunk ES:

# Notable event for certificate policy violation
| makeresults
| eval action="tigertrust_policy_violation"
| eval severity="high"
| eval source="tigertrust"
| eval type="certificate"
| sendalert notable

Splunk SOAR Playbooks

Automate response with SOAR:

# SOAR playbook for certificate expiration
def on_certificate_expiring(container):
    # Get certificate details
    cert = phantom.get_container_data(container)

    # Check if auto-renewal is possible
    if cert['auto_renew_enabled']:
        phantom.act('renew_certificate',
                   target='tigertrust',
                   parameters={'cert_id': cert['id']})
    else:
        # Create ticket
        phantom.act('create_ticket',
                   target='servicenow',
                   parameters={
                       'short_description': f"Renew certificate: {cert['common_name']}",
                       'urgency': 'high'
                   })

        # Notify team
        phantom.act('send_message',
                   target='slack',
                   parameters={
                       'channel': '#cert-alerts',
                       'message': f"Certificate {cert['common_name']} needs manual renewal"
                   })

Compliance Reporting

Generate compliance reports:

# Certificate compliance report
index=tigertrust sourcetype="tigertrust:certificate"
| eval compliant=if(key_size>=2048 AND algorithm!="SHA1", "Yes", "No")
| stats count by environment, compliant
| xyseries environment compliant count

# Audit trail report
index=tigertrust sourcetype="tigertrust:audit"
| table _time, user, action, certificate.common_name, result, src_ip
| sort -_time

Achieve comprehensive certificate security analytics with TigerTrust and Splunk.