• 포털 전문가 되기
• 다운로드
• 인쇄
• 내 다운로드 ()

• 지원
• 기술 문서
• Change Auditor 7.4
• Change Auditor 7.4 - SIEM Integration User Guide

Change Auditor 7.4 - SIEM Integration User Guide

콘텐츠 탐색  

Integrating Change Auditor and SIEM Tools

Webhooks in Change Auditor Webhook terminology Subscription configuration process

Subscription failover support

Subscription Management

Adding the PowerShell module Viewing available commands and help Connecting to Change Auditor Managing subscriptions

New-CAEventWebhookSubscription Get-CAEventWebhookSubscriptions Set-CAEventWebhookSubscription Remove-CAEventWebhookSubscription Get-CAEventExportSubsystems

Working with event subscriptions in the client Managing a Splunk integration

Working with Splunk subscriptions through the client New-CASplunkEventSubscription Get-CASplunkEventSubscriptions Set-CASplunkEventSubscription Remove-CASplunkEventSubscription

Managing an IBM QRadar integration

Working with QRadar subscriptions through the client New-CAQRadarExtension New-CAQRadarEventSubscription Get-CAQRadarEventSubscriptions Set-CAQRadarEventSubscription Remove-CAQRadarEventSubscription

Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration

Working with Change Auditor data within ArcSight Working with ArcSight subscriptions through the client New-CAArcSightEventSubscription Get-CAArcSightEventSubscriptions Set-CAArcSightEventSubscription Remove-CAArcSightEventSubscription

Managing a Quest IT Security Search integration (Preview)

Working with a Quest IT Security Search subscriptions through the client New-CAITSSEventSubscription Get-CAITSSEventSubscriptions Set-CAITSSEventSubscription Remove-CAITSSEventSubscription

Managing a Syslog integration

Working with Syslog subscriptions through the client New-CASyslogEventSubscription Get-CASyslogEventSubscriptions Set-CASyslogEventSubscription Remove-CASyslogEventSubscription

Managing a Microsoft Sentinel integration

Working with Microsoft Sentinel subscriptions through the client New-CASentinelEventSubscription Get-CASentinelEventSubscriptions Set-CASentinelEventSubscription Remove-CASentinelEventSubscription

Webhook technical insights

Handling webhook responses Our brand, our vision. Together. Contacting Quest Technical support resources

• Viewing Topics 1 - 4 of 59

×

Integrating Change Auditor and SIEM Tools

•	Webhooks in Change Auditor

•	Webhook terminology

•	Subscription configuration process

 

Webhooks in Change Auditor

Change Auditor administrators can configure Change Auditor to send events to a third party tool using webhook technology. This technology allows you to integrate Change Auditor with Splunk, IBM QRadar, Micro Focus Security ArcSight, Quest IT Security Search, or any other tool that accepts webhook notifications.

This guide is intended for customers who want to access and reuse the rich event data gathered by Change Auditor. It describes the configuration required to implement an integration with third-party tools.

Webhook terminology

•	Webhook receiver: A service that has one or more webhook endpoints and is a third party tool that can receive Change Auditor events.

•	Webhook endpoint: Specified with the NotificationUrl parameter, it is the web location where events are sent to inside the receiver.

•	Webhook subscription: A configuration that contains information on the webhook receiver and how events should be sent. This includes a notification URL, notification interval, and the coordinator responsible for event forwarding.

•	Notification: A message sent to the webhook receiver that contains a batch of events.

Subscription configuration process

NOTE: Port 9000 is used for sending events to SIEM tools. For optimal security, it is recommended that this port is blocked to incoming traffic on the coordinator host firewall.

To begin receiving event data, you need to:

1	Deploy a SIEM tool that can receive and process events from Change Auditor.

Create a webhook endpoint and configure it in your SIEM tool. The specifics for this are dependent on the tool that you are using.

Test the webhook receiver to confirm it is working properly.

2

Create and configure a subscription within Change Auditor. The subscription contains information such as where to send the events, which events to include, and the coordinator responsible for event forwarding. It also contains the heartbeat notification which is a message sent to the webhook receiver that notifies it that the Change Auditor coordinator is responsive. The heartbeat notification contains the bookmark time. The bookmark is the time the last event was sent in the event notification.

For details on using more than one coordinator to avoid the suspension of event sending due to connection issues, see Subscription failover support.

For details on creating subscriptions see Managing a Splunk integration, Managing an IBM QRadar integration, Managing a Micro Focus Security ArcSight Logger and Enterprise Security Manager (ESM) integration, and Managing a Quest IT Security Search integration (Preview).

3	Once the subscription is created, the coordinator polls the database and continuously pushes new events to the specified notification URL in the subscription. Events are sent based on the time specified in the subscription.

4

Validate that events are being sent and processed by running the Get-CAEventWebhookSubscriptions, Get-CASplunkEventSubscriptions, Get-CAQRadarEventSubscriptions, Get-CAArcSightEventSubscriptions, or Get-CAITSSEventSubscriptions commands. The information in these commands indicate if the events are being received.

Figure 1. Webhook integration process

 

•  이전
• Viewing Topics 1 - 4 of 59
• 다음 

이 문서 검색 이 제품 버전에 대한 모든 문서 검색 이 제품에 대한 모든 문서 검색 모든 문서 검색

셀프 서비스 도구

지식 기반

공지 및 알림

제품 지원

소프트웨어 다운로드

기술 설명서

사용자 포럼

비디오 자습서

RSS 피드

문의처

라이센싱 지원가져오기

기술 지원

모두 보기

×

 지원 시작

계열사 지원 사이트에서 Quest *제품*에 대한 온라인 지원 도움말을 볼 수 있습니다. 올바른 *제품* 지원 콘텐츠 및 지원에 연결하려면 계속을 클릭하십시오.

관련 문서

The document was helpful.

평가 결과 선택

I easily found the information I needed.

평가 결과 선택

© ALL RIGHTS RESERVED. 이용 약관 개인정보 보호정책 Cookie Preference Center