Trend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:https://docs.trendmicro.com/en-us/tippingpoint/security-managementsystem.aspx
Trend Micro, the Trend Micro t-ball logo, TippingPoint, and Digital Vaccine
are trademarks or registered trademarks of Trend Micro Incorporated. Allother product or company names may be trademarks or registeredtrademarks of their owners.
Copyright © 2023. Trend Micro Incorporated. All rights reserved.
Document Part No.: TPEM29834/230927
Release Date: December 2023
Protected by U.S. Patent No.: PendingThis documentation introduces the main features of the product and/orprovides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Privacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback
regarding product usage and detection information to Trend Micro. Some ofthis data is considered personal in certain jurisdictions and under certain
regulations. If you do not want Trend Micro to collect personal data, youmust ensure that you disable the related features.
The following link outlines the types of data that TippingPoint Security
Management System collects and provides detailed instructions on how todisable the specific features that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend
Micro Privacy Notice:https://www.trendmicro.com/privacy

Table of Contents
Chapter 1: Splunk Getting Started Guide
Chapter 2: SMS configuration
Create a Splunk syslog format .............................................. 2-2
Configure syslog exporter to send events to Splunk ............... 2-3
Configure syslog exporter to send messages to Splunk .......... 2-6

Chapter 3: Install the TippingPoint Splunk app
Search and specify time ranges ............................................ 3-2
Summary ........................................................................... 3-2
Action Based ...................................................................... 3-2
Distribution History ............................................................ 3-3
Packet Trace ....................................................................... 3-3iii

Chapter 1

Splunk Getting Started GuideVersion 2.0
The Trend Micro™ TippingPoint™ app contains pre-configured dashboards
that highlight blocked and permitted attacks in your environment. You canalso track security policy and Digital Vaccine updates and retrieve PCAPS
when available.
A Security Management System (SMS) is required to send data to Splunk.

1-1

Chapter 2

SMS configuration
SMS configuration includes creating a Splunk syslog format and configuringa syslog exporter to send events and messages to Splunk.
• Create a Splunk syslog format on page 2-2• Configure syslog exporter to send events to Splunk on page 2-3• Configure syslog exporter to send messages to Splunk on page 2-6

2-1

Splunk Getting Started Guide

Create a Splunk syslog format
To integrate Splunk with the SMS, first create a Splunk syslog format. Splunkrequires data in a specific format from the SMS.
Procedure
1.

On the SMS, select Admin > Server Properties > Syslog.

2.

Under Syslog Formats, click New.

3.

Select Events from the Log Type drop-down list.

4.

Enter a name and description.

5.

Enter the syslog pattern, as shown below.
ImportantThe example that follows has been formatted to fit the printed page.
When you copy and paste this syslog format example into the SMS, makesure that you remove all line breaks. Only spaces should separate fields.
If new lines get added between fields, the Splunk App regular expression
will incorrectly identify IPS event logs as the wrong Splunk source type.
CEF:0|TippingPoint|UnityOne|1.0.0.17|${signatureNumber}|${filterName}|${severity}|app=${protocol} cnt=${hitCount} dst=${destAddressv4} dpt=${destPort}
act=${flowControl} cn1=${vlanTag} cn1Label=VLAN ID cn2=${taxonomyID}
cn2Label=Taxonomy cn3=${packetTrace} cn3Label=Packet Trace cs1=${profileName}
cs1Label=Profile Name cs2=${policyUUID} cs2Label=Policy UUID cs3=${signatureUUID}
cs3Label=Signature UUID cs4=${deviceSegment} cs4Label=DeviceSegment
cs5=${smsName} cs5Label=SMS Name dvchost=${deviceName} cs6=${msgParameters}
cs6Label=Filter Message Parms srcip=${srcAddressv4} spt=${srcPort}
externalId=${eventID} rt=${eventTimestamp} cat=${categoryName} proto=${protocol}
deviceInboundInterface=${physicalPortIn} c6a2=${srcAddressv6} c6a2Label=Source
IPv6 c6a3=${destAddressv6} c6a3Label=Destination IPv6 request=${uriString}
requestMethod=${uriMethod} dhost=${uriHost} sourceTranslatedAddress=${clientAddressv4}
c6a1=${clientAddressv6} c6a1Label=Client IPv6 suser=${srcUserName} sntdom=${srcUserDomain}
duser=${destUserName} dntdom=${destUserDomain}

2-2

6.

Select an RFC compliant standard.

7.

Click OK.

SMS configuration

Configure syslog exporter to send events to Splunk
After you create a Splunk syslog format, you can configure the syslog
exporter to send device events, including paket trace files, from the SMS toSplunk.
Procedure
1.

On the SMS, select Admin > Server Properties > Syslog.
2-3

Splunk Getting Started Guide

2.

Under Remote Syslog for Events, click New.

3.

Select the Enabled check box.

4.

Enter the IP address of the Splunk server in the Syslog Server field.

5.

Select a Protocol.

6.

Enter 8514 for the Port number.

7.

Select the Splunk syslog format from the Log Type drop-down list.

8.

Select pipe from the Delimiter drop-down list.

9.

Select Include SMS Hostname in Header to send packet trace files.

10. Select Send New Events/Log Only.
11. Click OK.

2-4

SMS configuration

2-5

Splunk Getting Started Guide

Configure syslog exporter to send messages toSplunk
After you create a Splunk syslog format, you can configure the syslog
exporter to send SMS audit messages to Splunk. SMS audit messages also
include Digital Vaccine and profile distribution history information.
Procedure
1.

On the SMS, select Admin > Server Properties > Syslog.

2.

Under Remote Syslog for Events click New.

3.

Select the Enable check box.

4.

Enter the IP address of the Splunk server in the Syslog Server field.

5.

Select a Protocol.

6.

Enter 8514 for the Port number.

7.

Select SMS Audit from the Log Type drop-down list.

8.

Select a query from the Event Query drop-down list.

9.

Select Log Audit from the Facility drop-down list.

10. Select a severity from the Severity drop-down list.
11. Select Pipe from the Delimiter drop-down list.
12. Click OK.

2-6

Chapter 3

Install the TippingPoint Splunk app
To install the TippingPoint app on the Splunk Enterprise platform, selectApps > Browse more app and then search for TippingPoint.
Alternatively, you can directly download the app from the splunkbase https://splunkbase.splunk.com/app/3532/, and then select Install app from file.

3-1

Splunk Getting Started GuideSearch and specify time ranges
Click Search on the TippingPoint Intrusion Prevention System app toperform a Splunk Enterprise search and to review your search history.
To filter Splunk data by time period or to adjust the time period, select apreset from the Period/Range. Data is sent to Splunk as it is generated. By
default, data displays in real-time (All time). You can filter your results fromthe last minute, hour, day, week, or month. To narrow larger sets of data to a
specific time period, you can configure your own custom date and timerange.
To synchronize Splunk data, reload the page on your web browser.

Summary
Click Summary on the TippingPoint Intrusion Prevention System app to viewthe following event data:• Top permitted attacks by filter name and hit count• Top permitted sources by source IP address, hit count, and country• Top permitted destinations by destination IP address, hit count, andcountry• Top blocked or quarantined attacks by filter name and hit count• Top blocked or quarantined sources by source IP address, hit count, andcountry• Top blocked or quarantined destinations by destination IP address, hitcount, and country

Action Based
Click Action Based on the TippingPoint Intrusion Prevention System app toview the following action sets:• All• Permitted - Top attacks by filter name, top sources, and top destinations3-2

Install the TippingPoint Splunk app• Blocked - Top attacks by filter name, top sources, and top destinations• Quarantined - Top attacks by filter ID, top attacks by filter name, topsources, and top destinations

Distribution History
Click DV Distribution History on the TippingPoint Intrusion Prevention
System app to track Digital Vaccine and profile distributions. Digital Vaccine
distributions include the version and distribution time for each device.
Profile distributions include the profile name, device or segment, and thedistribution time.

Packet Trace
Click Packet Trace on the TippingPoint Intrusion Prevention System app toview packet trace information for events on the SMS. You can search forpacket trace information by Event ID.
To download a packet trace, copy and paste the API Key from the SMS, andthen click Download. To access the API Key on the SMS, select Admin >Authentication and Authorization > Users > Authentication.
The following information displays.
ColumnDescription

SMS Server Name

Domain name of the SMS server.

SMS Server IP

IP address of the SMS server.

Event IDSMS event identifier (Event No).

Source IPSource IP address for the event.

Source PortPort of the source IP address.

Destination IP

Destination IP address for the event.

Destination Port

Port of the destination IP address.

Device Name

Name of the IPS/TPS device that generate the event.

3-3

Splunk Getting Started Guide

Column3-4

Description

Segment Number

Segment for the event.

Event TimeThe time that the event was created.

Item Code: TPEM29834/230927