Splunk DB Connect

Splunk DB Connect is an application from Splunk Enterprise you can install in your Splunk Enterprise instance. Splunk DB Connect retrieves events from the database you define, such as BeyondTrust Endpoint Privilege Management Reporting, and inserts the events into Splunk Enterprise.

You can use Splunk DB Connect to query the Export Views for Endpoint Privilege Management.

You can use SQL authentication or any of the default Endpoint Privilege Management Reporting accounts to authenticate with the BeyondTrust database. The default accounts are Report Reader, Event Parser, and Data Admin.

You can retrieve events from your endpoints or your Windows event collector node instead.

Install DB Connect

Prerequisites

• Splunk Enterprise 6.4.0 or later
• Java Platform, Standard Edition Development Kit (JDK) from Oracle. JDK is required. The JRE alone is not sufficient.
• Java Database Connection (JDBC) to connect to databases

📘

For more information, see the following:

Java downloads

Deploy and Use Splunk DB Connect

Install on Splunk Enterprise

1. Open your Splunk Enterprise instance, and click App: Search & Reporting from the top menu bar.
2. If DB Connect is installed, it appears in the list. Otherwise, click Find More Apps.
3. Type DB Connect in the search box if Splunk can connect to the internet. Follow the onscreen instructions to install DB Connection. Alternatively, you can download DB Connect from the Splunk store to install manually.
4. Click App: Search & Reporting > Manage Apps to install DB Connect from a separate installer.
5. Click Install app from file and browse to the location of DB Connect you downloaded.
6. Click Upload and follow the onscreen instructions to install DB Connect.
7. After DB Connect is installed, you can access it from the App: Search & Reporting top menu.

Configure Splunk DB Connect

1. Click App: Search & Reporting > Splunk DB Connect.
2. Click Configuration > Settings.
3. On the General tab, configure the path to your JRE installation on the machine hosting Splunk. The JVM Options and Task Server Port are configured by Splunk.
4. Click Save to confirm your settings.
5. Click the Databases tab, and then the Identities tab.
6. Click New Identity. This is the identity (user) Splunk uses to authenticate to the BeyondTrust database to export events.
   • Enter an Identity Name you will use to identify the user.

• You can either use SQL authentication as shown here, or you can use Windows authentication and any of the Endpoint Privilege Management Reporting accounts that are set up by the installer: ReportReader, Event Parser and Data Admin.

• Click Save to confirm your identity.

ℹ️

Note

Use the default permission Splunk Enterprise provides on the Permissions tab.

Create a new Splunk connection

1. Click the Connections tab. This is where you configure the database you will connect to.
   • Enter a Connection Name. This is to identify the connection in Splunk.
   • Select the Identity you created from the dropdown list.
   • Select the Connection Type, MS SQL Server Using MS Generic Driver.
   • Enter the host IP address of your database server. Leave the port as the default 1433.
   • Enter the Default Database as the one containing your Endpoint Privilege Management Reporting data.
   • You can choose to configure the additional options if they are relevant for your environment.
   • Click Save to save your connection. This will also validate the connection.

ℹ️

Note

Use the default permission Splunk Enterprise provides on the Permissions tab.

2. Click the Data Lab tab and click New Input on the right-hand side.

• Enter a Name for you to identify the new Input by. You can also enter a Description if required.
• Leave the App dropdown list as Splunk DB Connect.
• Select your Connection from the dropdown menu. This also validates it.

3. Click Continue. This allows you to choose and preview a table. You can now import the Export Views into Splunk. These are ExportDefendpointStarts, ExportDefendpointLogins, ExportPrivilegedAccountProtection, and ExportProcesses. This example uses the ExportDefendpointStarts view.

• Select Rising Column. This ensures the events from the Reporting database are incremented rather than retrieving the same events repeatedly.
• You can manually type a SQL query into the field or select the Checkpoint Column and the Checkpoint Value. Use a ? as a placeholder in your SQL query for the Checkpoint Value as you set this manually.

4. Click Execute to search for the specified events in the Reporting database. This does not insert them into Splunk.

You can modify the SQL query to filter your results. This will help limit the data imported into Splunk Enterprise and your associated costs. For example, this SQL query imports events where the Endpoint Privilege Management version is 4.3.349.0 only.

SELECT *
FROM exportdefendpointstarts
WHERE sessionid > ?
AND AgentVersion='4.0.349.0'
ORDER BY sessionid asc

5. Click Execute to search for the events in the Reporting database. These are displayed below.
6. Click Continue. Set parameters for the input here if required.
7. Click Continue. Each event imported into Splunk has the metadata you configure here as part of it. You can configure a new Sourcetype from the Settings menu on the top-right if required.
8. Click Save to confirm your Input Type and start importing events into Splunk.

Repeat steps 7 to 11 for each of the Export Views.

Work with data in Splunk Enterprise

When using Splunk DB Connect to import data, BeyondTrust provides four denormalized views:

• ExportDefendpointStarts
• ExportLogons
• ExportPrivilegedAccountProtection
• ExportProcesses

The views allow you to import BeyondTrust audit data into SIEM systems such as Splunk Enterprise. Each view has a rising column allowing the SIEM system to track the data already imported.

ExportProcesses

Returns the Process Control events such as elevating or blocking applications.

The columns include:

• ApplicationDescription
• Publisher
• ProductVersion
• UserName
• HostName
• WorkstyleName

Also includes event action flags:

• Elevated
• Blocked
• Passive

ProcessID is the rising column and ProcessStartTime is the timestamp.

ExportLogons

Returns the Logon events in the database.

• LogonTime

• UserName

• HostName

• WorkstyleName

  LogonID is the rising column and LogonTime is the timestamp.

ExportDefendpointStarts

Returns the Endpoint Privilege Management started events in the database.

The columns include:

SessionStartTime

HostName

AgentVersion

OS

SessionID is the rising column and SessionStartTime is the timestamp.

ExportPrivilegedAccountProtection

Returns the Endpoint Privilege Management events in the database.

The columns include:

• TimeGenerated
• Access
• WorkstyleName
• UserName
• HostName
• ApplicationDescription

ID is the rising column and TimeGenerated is the timestamp.

ℹ️

Note

For more information about the fields for each Endpoint Privilege Management export view, see the next section.

Export views

When using Splunk DB Connect to import data, BeyondTrust provides four denormalized export views for Endpoint Privilege Management events:

• ExportDefendpointStarts
• ExportDefendpointLogons
• ExportPrivilegedAccountProtection
• ExportProcesses

Each of the views can be queried in Splunk. For each view, the following data is sent to Splunk. These Export Views are correct as of Endpoint Privilege Management Reporting 4.5.

ExportDefendpointStarts

ExportDefendpointLogons

ExportPrivilegedAccountProtection

ExportProcesses