SIEM settings | EPM-WM Cloud

🚧

Important information

Action required: migrate to app-based SIEM integrations

The in-product QRadar, Splunk, and Sentinel integrations are deprecated and will be removed in a future release of EPM Cloud. App-based replacements are available now in their respective marketplaces and provide a more capable and fully supported integration.

Amazon S3 is not affected.

For migration guidance and links to the app-based integrations, see SIEM integrations for EPM Cloud.

Configure SIEM settings to send audit event data to an accessible SIEM provider.

ℹ️

There can only be one SIEM tool configured. If you choose to add details for a new SIEM tool, existing settings data will be lost.

Events are queued and sent in batches in one-minute intervals. This is not configurable. A folder is created where the batches are saved. You can open and download the batch file, which stores the event data in JSON format.

Starting in EPM 23.1, the ECS mappings are updated for SIEM integrations.

If you previously configured SIEM settings and selected the ECS format, then there are two ECS format menu items: ECS - Elastic Common Schema and ECS - Elastic Common Schema (Deprecated). To update to the new ECS schema, select ECS - Elastic Common Schema, and then click Validate Settings.

ℹ️

For a list of supported events in 23.1 and later, see EPM ECS events.

Event types

Events include computer, activity, and authorization requests. Events are sent in the selected format (CIM or ECS).

ℹ️

For SIEM integrations using the CIM (Deprecated) format or ECS - Elastic Common Schema, we only support a subset of all event types (see the table below).

Configure AWS S3 bucket

You must configure the S3 bucket details before you can configure the SIEM integration in EPM-WM. In AWS, set up the bucket and access to the bucket. This includes:

• Create a bucket. When creating the bucket be sure to note the bucket name and region. You need to enter the information when configuring the settings in EPM-WM.

• Create an access policy. When creating the access policy, the permissions required for the integration:

  Permission	Resource ARN	Required?
  s3:GetBucketLocation	arn:aws:s3:::	Yes
  s3:PutObject	arn:aws:s3:::/*	Yes
  s3:DeleteObject	arn:aws:s3:::/*	Recommended (cleanup of validation probe objects)

• Add a user. When attaching a user to a policy, be sure to select Programmatic access as the access type and Attach existing policies directly as the permission type. Copy the Access ID and secret access key to a file; you need to enter the details when configuring the settings in EPM-WM.

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:GetBucketLocation",
        "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME"
      },
      {
        "Effect": "Allow",
        "Action": ["s3:PutObject", "s3:DeleteObject"],
        "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
      }
    ]
  }

🚧

Important information

s3:PutObject and s3:DeleteObject are object-level actions. They must be scoped to arn:aws:s3:::<bucket>/*, not arn:aws:s3:::<bucket>. A bucket-level ARN will cause validation to fail with AccessDenied.

ℹ️

For more information, see AWS documentation:

• Create your first S3 bucket
• Creating IAM policies
• Creating an IAM user in your AWS account
• List contents of buckets

Add the AWS S3 bucket in EPM

1. Select Configuration, and then select SIEM Settings.
2. Select Enable SIEM Integration to turn on the feature.
3. From the Integration Type list, select S3
4. Enter the details for your storage site:
   • Access Key ID: Enter the value created when you added the user.
   • Secret Access Key: Enter the value created when you added the user.
   • Bucket: Enter the name of the S3 bucket.
   • Region: Select or search for the name of the region where your storage bucket resides.
5. Select the data format: CIM - Common Information Model or ECS - Elastic Common Schema.
6. Select Server-Side Encryption to encrypt files sent to the S3 bucket using the default AWS encryption key.
7. Click Validate Settings to test the connection to your storage site.
8. Click Save Settings.

If you no longer want the SIEM integration active, click Enable SIEM Integration to turn the feature off.

Add Splunk to EPM

⏰

Deprecation notice

This integration is deprecated and will not be available in-product in a future release.

Migrate to the dedicated BeyondTrust app on Splunkbase. See the Splunk migration guide for steps.

1. Select Configuration, and then select SIEM Settings.
2. Select Enable SIEM Integration to turn on the feature.
3. From the Integration Type list, select Splunk.
4. Enter the details for your Splunk configuration:
   • Hostname. Do not include https:// in the hostname.
   • Index
   • Token
5. Select the data format: CIM - Common Information Model or ECS - Elastic Common Schema.
6. Click Validate Settings to test the connection to Splunk.
7. Click Save Settings.

Add Microsoft Sentinel to EPM

⏰

Deprecation notice

This integration is deprecated. New Sentinel integrations cannot be configured in EPM Cloud from release 26.2.

The Microsoft Data Collector API that this integration relies on is on a deprecation path. See Migrate from the HTTP Data Collector API to the Log Ingestion API. Existing in-product integrations may stop working without notice.

Migrate to the dedicated Sentinel solution on Azure Marketplace. See the Sentinel migration guide for steps.

1. Select Configuration, and then select SIEM Settings.
2. Select Enable SIEM Integration to turn on the feature.
3. From the Integration Type list, select Sentinel.
4. Enter the details for your Sentinel configuration:
   • Workspace ID: Enter the Sentinel workspace ID. In Sentinel, the workspace ID is located in this path: Settings > Workspace Settings > Agents Management.
   • Workspace Key: Enter the primary key. In Sentinel, the workspace key is located in this path: Settings > Workspace Settings > Agents Management.
   • Custom Log Table Name: The table is listed under the Custom Logs category in Azure Sentinel. A _CL suffix is automatically appended to the end of the custom log table name. A custom log is created if the table name does not exist.
5. Select the data format: CIM - Common Information Model or ECS - Elastic Common Schema.

6. Click Validate Settings to test the connection to Sentinel.
7. Click Save Settings.

Add QRadar to EPM

⏰

Deprecation notice

This integration is deprecated and will not be available in-product in a future release.

Migrate to the dedicated QRadar app on IBM X-Force Exchange. See the QRadar migration guide for steps.

To configure QRadar in EPM:

1. Select Configuration, and then select SIEM Settings.
2. Select Enable SIEM Integration to turn on the feature.
3. From the Integration Type list, select QRADAR.
4. Enter the details for your QRadar configuration:
   • Hostname. Do not include https:// in the hostname.
   • Port
   • Cert: This is the client certificate required when sending events to a syslog server using mutual TLS (mTLS) authentication.
   • Key: This is the mTLS client certificate private key. The private key must be generated as PKCS #8.
5. Select the data format: CIM - Common Information Model or ECS - Elastic Common Schema.
6. Click Validate Settings.
7. Click Save Changes to confirm and save.

You must create an API account so QRadar can make API calls to EPM. The account requires read-only access to Audit and Reporting APIs.