OTHER SIEM INTEGRATION CASE STUDIES
Pulse Secure integration (Add-on) with SplunkIntegration with LogRhythm
Secure Access Platform integration(Add-on and App ) with Splunk
CASB Platform integration (Add-on and App ) with Splunk
DNS Platform integration (App ) with Splunk
Business Risk Intelligence Platform integration ( Add-on) with Splunk
Infrastructure Monitoring Platform integration ( Add-on) with Splunk
Categories
Customer
Customer is a leading SIEM solution provider.
They provide a platform for companies to aggregate and act upon Threat Intelligence.
Requirement
Customer requested to build a Connector to integrate their platform with Cisco AMP End Event Monitoring to collect events and perform orchestration action like isolation, unisolation based on file hash, IP address, change host group, and add IOC list based on security alert or event.
Technology Solution
Sacumen developed the Connector app to integrate Cisco AMP using java, and Apache REST. The Connector app performs the following actions:
Set up the prerequisites
Login Cisco AMP Endpoint
Setup the Connect App
Authenticate using API (REST) with Basic OAuth , the access using API Key and Client ID.
Collect the events
Collect event based on a filter like event type, event creation date
Sampling of the records to calculate estimated EPS.
Calculate the error rate.
Calculate bandwidth consumption.
Perform orchestration action like isolate host, change host group, and add a host to IOC list
info@sacumen.com
+91 80 4976 5878
There are no reviews yet.