Entrust Identity as a Service Add-on for Splunk
Overview
Details
The Entrust Identity as a Service Add-on for Splunk enables centralizing your Identity as a Service authentication and management audit events in Splunk™ Enterprise and Splunk™ Cloud. This enables administrators and security compliance teams to have a holistic view of events across their core infrastructure. By centralizing these events, administrators can create reports and dashboards using the Identity as a Service audit events. Security teams can quickly diagnose potential attacks by monitoring for the frequency of authentication failures.
Documentation:
Refer to the Admin Guide from your Entrust Identity as a Service account for assistance.
Configuration:
Before configuring the add-on, customers must create a Splunk application prior to this step. See the Identity as a Service Admin Online Help for more information.
To configure your add-on, complete the following steps after downloading and installing the add-on:
1. Create a new input for your Identity as a Service source.
2. Select the category of logs you would like to import from Identity as a Service into Splunk. The categories are:
a. Authentication Events
b. Management Events
c. Both (By default both categories are selected)
3. Enter the interval (in seconds) to set the frequency that audit logs in Identity as a Service are imported into Splunk. The interval cannot be less than 30 seconds. The first time the add-on is enabled, all events are imported into Splunk. After that, events are imported at the set interval rate.
4. Under Configuration > Add-on Settings enter the json value that was created when you added a Splunk application in Identity as a Service.
Upon successful configuration, this add-on will automatically import all previously logged audits for the specified category into Splunk.
Once the data source is enabled and data is being pulled in, administrators can create dashboards with Identity as a Service audit data.
Release Notes
Version 1.6.2
This version is rebuilt based on Splunk Add-on Builder 4.4.1 to resolve Splunk SDK Python dependency issue. No function changes.
Support Splunk Enterprise platform version 9.4, 9.3, 9.2
Version 1.6.1
Version 1.6.1, built with the latest Add-on Builder version 4.1.4. No other function changes. Support upgrade from previous version (1.6.0).
Version 1.6.0
This is built with the latest version of Add-on Builder version 4.1.3. Note that we don't support an upgrade to this version, but rather a full installation.
Version 1.5.0
Updated to support the latest Splunk platform.
Version 1.4.0
Timezone bug fix.
Version 1.3.0
Support for Splunk Cloud.
Version 1.2.0
• Support for Splunk Cloud.
• Product Rebranding.
Version 1.1.0
Updated for Splunk 8.
Version 1.0.3
Updated the supported Splunk versions to include 7.3.
Version 1.0.1
Version 1.0.0
Version 1.0.0
- Initial Release