Integrations

• 1: Supported Integrations
• 2: Create
• 3: High Availability
• 4: Details and Status
• 5: Delete
• 6: Generic Log Sources

1 - Supported Integrations

Integrations facilitate the ingestion of data sources from a wide range of third party vendors. Our Integrations are updated regularly as new and emerging technologies are released.

Each Integration typically requires a configuration guide outlining steps you must follow to integrate your data source to the SamurAI platform.

For details such as transport methods and logs collected please refer to each supporting vendor configuration guide by clicking the link in the table or browsing directly to Product Integration Guides.

All supported integrations are categorized according to our Detection Categorization. For further information refer to the following article: Telemetry Data Source Categorization.

Available configuration guides

In the pipeline

Outlined below are integrations we have in the pipeline however have no committed dates for support. Please note any integration may be influenced by changing business opportunities and client requirements. Please contact NTT for further information or if you require additional support.

2 - Create

Create Integration

1. From the SamurAI Portal click Telemetry and select Integrations from the main menu.
2. Click Create integration.
3. Select the product you wish to integrate with the SamurAI platform.
4. Click Next. Dependent on how we collect telemetry, the product may be integrated via a Cloud Collector or Local Collector. Follow the steps based on the Collector type:

Cloud Collector

1. If the integration is cloud-based you need to select the relevant Cloud Collector. Select the relevant Cloud Collector and click Next.
   • If you are using a public cloud storage account you should already have completed the steps in Cloud Collector.
   • If no cloud storage is utilized then a default cloud collector is available.
2. Select Configuration Guide which will direct you to SamurAI documentation outlining how to configure your product and obtain required fields.
3. Once you have configured your product, complete the required fields.
4. Select Finish.

Local Collector

1. Your Local Collector(s) will be listed. Select the Local Collector that you will integrate the product with.
2. Click Next (typically this is the syslog destination host when configuring your device). If you do not have a Local Collector setup and deployed, follow the steps in our SamurAI Local Collector article.
3. The Local Collector IP Address will be displayed, copy the IP address or take note of it.
4. Click Configuration Guide which will direct you to SamurAI documentation outlining how to configure your product.
5. Based on the product, Extended Data Collection may be displayed, if so jump to Extended Data Collection.
6. Click Finish

Extended Data Collection

For many products we are able to collect extended data enhancing our threat detection capabilities and accuracy, for example Packet Capture (PCAP) data. This option will be displayed during configuration of an integration.

1. If extended data collection is available for the product, you can choose to enable or disable via the toggle. If you choose to disable, Select Finish
2. If you choose to enable extended data collection you must complete all the necessary fields. The parameters for each field are derived from following the associated product configuration guide. Once complete, Select Finish

3 - High Availability

If you have products configured in a High Availability configuration e.g. Active/Passive pair you have the option to configure HA Groups.

HA Groups are important for telemetry health monitoring and notifications. An example scenario is if you have an Active/Passive product configuration where the Active node consistently sends data to a local collector, however the Passive node sends intermittent data. In this scenario the Active node status would be reported as OK, however the Passive node status may appear as Critical despite there not being a telemetry ingestion problem.

HA Group telemetry monitoring is handled based on the ‘best’ state of all members e.g in the scenario above if a HA Group has two members and one member has an OK status, and the second member has Critical status the overall group state will be considered OK.

Create HA Group

1. Click Telemetry and select Integrations from the main menu
2. Click (more options) at the top right of the table and select Create HA Group
3. A Create HA Group window will be displayed

Figure 1: Create HA Group window

4. Enter a Name for the HA Group
5. From the drop down menu select the integrations to be members of the HA Group
6. Click Confirm

Within the Integrations table, the field type HA Group will be displayed with the number of members highlighted.

Edit a HA Group

1. Click Telemetry and select Integrations from the main menu
2. Click on (more options) to the left of the HA Group and select Edit HA Group
3. Add or remove the group members required
4. Click Confirm

Delete HA Group

1. Click Telemetry and select Integrations from the main menu
2. Click on (more options) to the left of the HA Group and select Delete HA Group
3. A confirmation window will be displayed, Click Confirm

The HA Group will be deleted and integrations listed within the table.

4 - Details and Status

View Integration

There are multiple methods of viewing your integrations.

To view integrations associated with a specific collector:

1. From the SamurAI Portal click Telemetry and select Collectors from the main menu
2. Select the relevant Collector
3. All integrations associated with the Collector will be displayed with associated information

You can also view all integrations regardless of collector:

1. Click Telemetry and select Integrations from the main menu
2. An Integrations table will be displayed with all of your Integrations listed

Click on the specific integration to view configuration parameters. You can edit and update a description to help keep track of the integration.

For integrations of type Log an events graph will be displayed. This is a useful indicator of the number of events over a given period and may show spikes and drops in events.

Figure 1: Example events graph

By clicking the time picker you can update the events graph to a specific date and time range. We default to the Last 7 days however have included Quick time ranges.

Figure 2: Data and time selector

From the events graph you can pivot directly into Advanced Query by selecting the magnifying glass icon () to view the underlying event data.

Views

You can save filters you set through views. This is useful if, for example, you have a large number of integrations and wish to view only specific products or types of integration.

Click Views to save/reset/delete your different filters. Once saved you can toggle between views.

Figure 3: Views drop down

Integration Status

Potential status displayed are included in the table below:

Status Thresholds

The SamurAI platform defines default Warning and Critical thresholds for each integrated product. These thresholds determine when an integration status is reported as Warning or Critical. You can adjust these values per product (e.g for all integrated Palo Alto NG Firewalls) or per integration (e.g for a single Palo Alto NG Firewall). Refer to Custom Thresholds for further information.

To view the default status threshold per product:

1. Click on more options () to the right of the table as depicted:

Figure 4: Status thresholds option

2. Select Status Thresholds per product

Figure 5: Example default status thresholds per product

Status threshold per product will be displayed, defined in single units or a combination as d (days), h (hours) and m (minutes).

In the example above (Figure 5) for all integrated Cisco: Secure Firewall (FTD) the default thresholds are:

• Warning: 4h. If the SamurAI platform does not receive or ingest any events after 4 hours, the integration status is updated to Warning (displayed within the Integrations Table and the Telemetry Monitoring Table).
• Critical: 10h. If the SamurAI platform does not receive or ingest any events after 10 hours, the integration status is updated to Critical (displayed within the Integrations Table and the Telemetry Monitoring Table, and an email notification is sent to registered users (by default) or as configured by each user.

Custom Thresholds

Custom thresholds can be set per Product (e.g for all integrated Palo Alto NG Firewalls) and/or per Integration (e.g for a single integrated Palo Alto NG Firewall). Set thresholds using a single or combination of time units. Use d for days, h for hours and m for minutes e.g 12h or 1d 2h 10m.

Adjust thresholds per Product

1. Click on more options () to the right of the table
2. Select Status Thresholds per product
3. Enter the Warning threshold in days, hours and/or minutes for the Product
4. Enter the Critical threshold in days, hours and/or minutes for the Product
5. Click Save

Adjust thresholds per Integration

1. Click on more options () to the left of the integration
2. Select Status Thresholds
3. Enter the Warning threshold in days, hours and/or minutes for the integration
4. Enter the Critical threshold in days, hours and/or minutes for the integration
5. Click Save

Once saved:

• The integration will display an Info icon ()
• Hovering over the icon will display Custom Status Threshold text with the threshold set per status

Integration Email Notifications

By default email notifications are enabled. The SamurAI platform sends email notifications to registered users when an integration is reported as Critical e.g. the SamurAI platform has not receieved or ingested any data from the integrated product according to the defined threshold, however this is fully customizable.

Email notifications can be set per Product (e.g for all Palo Alto NG Firewalls) and/or per Integration (e.g for a single Palo Alto NG Firewall). Registered users can also customize what email notifications they receive. Refer to User Notifications Settings.

Enable or disable email notification per Product

1. Click on more options () to the right of the table
2. Select Notifications Per Product
3. Toggle the setting to enable or disable by selecting the bell icon. Alternatively you can select the default setting
4. Click Save

Figure 6: Example notification settings

Enable or disable email notification per Integration

1. Click on more options () to the left of the integration
2. Select Notifications
3. A Notifications Settings window will be displayed
4. Toggle the setting to enable or disable by selecting the bell icon. Alternatively you can select the default setting
5. Click Save

Hide Integration

Hiding an integration will remove it from the integrations displayed and also from the Telemetry Monitoring view and disable notifications.

Only integrations of type Log can be hidden. Some reasons why you may want to hide an integration include:

• You may want to hide all of your unsupported/generic log source integrations.
• And you do not want to receive notifications if there is an issue with telemetry ingestion to the SamurAI platform.

To hide an integration:

1. Find the relevant Log integration within the table
2. Click on more options () select Hide integration
3. A Hide Log Integration window will be displayed, click Confirm

To view any hidden integrations:

1. Click on more options () at the top right of the table and select Hidden log integrations
2. A Hidden Log Integrations window will be displayed with hidden integrations

Unhide Integration

1. Click more options () at the top right of the table and select Hidden log integrations
2. A Hidden Log Integrations window will be displayed
3. Find the relevant Hidden integration
4. Click on more options () to the left of the integration and select Unhide integration

5 - Delete

Delete Integration

If you wish to delete an integration associated with a specific Collector:

1. From your SamurAI Portal Telemetry and select Collectors from the main menu
2. Select the relevant collector from your list
3. You will now see all integrations associated with the collector
4. Select your integrations
5. On the right hand side of the relevant integration, click on (more options) and select Delete Integration
6. The following warning will appear: ‘Warning: This is a destructive action and cannot be reversed.’. To ensure you intended to delete the integration you will need to type in the highlighted ‘Integration’s Hostname’ and select Delete Integration

You can also delete from the Integrations menu item:

1. Click Telemetry and select Integrations from the main menu
2. Find and select your integrated product
3. On the right hand side of the relevant integration, click on (more options) and select Delete Integration

6 - Generic Log Sources

While we make an effort to support a wide variety of Integrations and different types of log sources, it is possible that there may be a log source that you would like to ingest into the SamurAI platform which we are not able to parse and analyze. This is especially true for events generated via syslog log sources.

The fact that we are not able to use a log source for detections doesn’t mean that it won’t still be useful to ingest into the SamurAI platform. We will ingest any event data, provided via syslog (sent to a SamurAI local collector), into our data lake and you will still be able to analyze that event data using Advanced Query. This allows you to include events from generic log sources when you are performing queries.

If a log source, ingested via syslog, does not match one of our supported integrations, we will ingest the log events, which will still contain, amongst others, the following fields:

• timestamp: the time at which the log message was ingested
• collector: the id of the collector which ingested the event
• host: the source host from which the event was received
• raw: the complete raw log message

You can then proceed to query these events using Advanced Query. For example, the following KQL query finds all the attempts to connect to a host using invalid user ids and then counts the attempts by source IPv4 or IPv6 address:

events | where host == "10.1.1.1" and i(raw contains "Invalid" or raw contains "failed") and raw !contains "connect" | project timestamp, user = extract("user ([a-zA-Z0-9\\-]+) from ", 1, raw), ipaddr = extract(".+ ([0-9a-f]+[\\:\\.][0-9a-f\\.\\:]+) ", 1, raw) | summarize num_attempts = count() by ipaddr| order by num_attempts

The output is ordered by the number of attempts from each IP address, producing a table like the following: