Recommended Configuration for known SIEM Platforms

Avanan can integrate with a large number of SIEM platforms.

Note:

If you need help in configuring your SIEM platform to integrate with Avanan, contact Avanan Support.

These are the recommended configuration for some of the SIEM platforms.

SIEM Platform

Transport Method

Log Format

Splunk

Splunk HTTP Event Collector (HEC)

  • HTTP Event Collector Host / URI - Host or URI value from Splunk HEC configuration

  • HTTP Event Collector Token - value from Splunk HEC configuration

JSON (Splunk HEC/CIM compatible)

Microsoft Sentinel

Azure Sentinel

  • Tenant ID

  • Endpoint

  • Data Collection Rule ID

  • Data Collection Rule Table Name

  • Client ID

  • Client Secret

JSON (Sentinel compatible)

CrowdStrike

See CrowdStrike Integration.

CrowdStrike Event Collector Host / URL

Bearer Token

JSON (Crowdstrike ECS compatible)

Google Chronicle

Customer ID - Unique identifier (UUID) corresponding to your Chronicle instance.

Account Region - Region where your Chronicle instance is created.

Credentials JSON - Google Service Account credentials.

Note:

If the Credentials JSON option is not available, contact Google support.

Ingestion API - Google Chronicle Ingestion API type:

  • Unified Data Model (UDM) event

    Note:

    If you choose Unified Data Model (UDM) event option, make sure to select this format: JSON (Google UDM Compatible).

  • Unstructured log

    Note:

    If you choose the Unstructured log option, make sure to select this format: Google Chronicle Unstructured Logs.

JSON (Google UDM Compatible)

Cortex XSOAR

Cortex XSOAR content pack

To integrate with Cortex XSOAR, see Configuring Integration with Cortex XSOAR by Palo Alto Networks

JSON (Rapid7, <8k characters)

Torq

HTTP Collector

  • HTTP Collector URL (HTTP/HTTPS) - value from Torq

    For example, https://myconnector.mycompany.com

JSON

Rapid7

AWS SQS

JSON (Rapid7, <8k characters)

Elastic

HTTP Collector

  • HTTP Collector URL (HTTP/HTTPS) - value from Elastic

    For example, https://myconnector.mycompany.com

JSON (Elastic ECS compatible)

Sumo Logic

HTTP Collector

  • HTTP Collector URL (HTTP/HTTPS) - value from Sumo Logic

    For example, https://myconnector.mycompany.com

JSON

Azure Log Workspace

Azure Log Workspace

  • Azure Log Workspace ID - value from Azure configuration

  • Azure Log Workspace Shared Key - value from Azure configuration

JSON

LogRhythm

AWS S3

For the fields required for AWS S3, see Supported Transport methods.

If a new S3 Bucket is needed, you should follow specific instructions while configuring the S3 bucket. For more details, see Forwarding Events to AWS S3.

JSON

McAfee SIEM

AWS S3

For the fields required for AWS S3, see Supported Transport methods.

If a new S3 Bucket is needed, you should follow specific instructions while configuring the S3 bucket. For more details, see Forwarding Events to AWS S3.

To receive the logs from S3 bucket to McAfee SIEM, refer to Configuration of Amazon S3 upload feature and McAfee Documentation.

JSON

Other

Avanan can integrate with any SIEM platform. If you need help in configuring your SIEM platform to integrate with Avanan, contact Avanan Support.

 -